Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0d1f0fe7e5a5fb3…

MALICIOUS

PDF

74.4 KB Created: 2021-06-02 19:40:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee85c91bba24da350575b2438ca82425 SHA-1: a900b669c2edc93265a125de8baeecdea166def8 SHA-256: b0d1f0fe7e5a5fb3b527c9a5087d2908a4ee17ea4958fcfbdc7553e077afc1d1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for Pdf.Phishing.Trojan. The embedded URL 'https://smidgel.ru/pbw?utm_term=the+last+jedi+art+book+pdf' is a strong indicator of a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect the user to a malicious site, likely as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/pbw?utm_term=the+last+jedi+art+book+pdf
    • https://static.s123-cdn-static.com/uploads/4411701/normal_5fe1107338468.pdf
    • https://cdn-cms.f-static.net/uploads/4422645/normal_601a02338c4b5.pdf
    • https://cdn-cms.f-static.net/uploads/4403119/normal_604b56bc114e4.pdf
    • https://cdn-cms.f-static.net/uploads/4407989/normal_603e9085a19a1.pdf
    • https://cdn-cms.f-static.net/uploads/4446016/normal_6067e0c6d6334.pdf
    • https://cdn-cms.f-static.net/uploads/4366995/normal_601983cd6549c.pdf
    • https://static.s123-cdn-static.com/uploads/4422150/normal_6008eb9664011.pdf
    • https://cdn-cms.f-static.net/uploads/4365613/normal_6029d8a5ab1ba.pdf
    • https://static.s123-cdn-static-d.com/uploads/4387061/normal_60b26a51c4b1a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c2b35d1f-0cd0-4005-903e-155ae92b0c06/romevuwomukipasoro.pdf
    • https://uploads.strikinglycdn.com/files/bf9d811a-d5f1-4f5b-945d-edde0d7cda43/how_to_assemble_nordictrack_s22i_treadmill.pdf
    • http://kipizasuzeda.pbworks.com/f/jack_and_the_beanstalk_book.pdf
    • http://sajateves.pbworks.com/f/84851558055.pdf
    • https://uploads.strikinglycdn.com/files/57c227cc-e40f-481a-822c-7418d587cb42/hp_deskjet_2547_scannen.pdf
    • http://sufizilofab.pbworks.com/f/how_to_get_unlimited_coins_and_diamonds_in_dls_2020.pdf
    • http://didaneguk.pbworks.com/f/hotstar_mod_apk_for_pc.pdf
    • http://mupalunava.pbworks.com/f/realidades_2_3b_page_64.pdf
    • http://gosirata.pbworks.com/f/tableau_de_rpartition_des_charges_indirectes_exercices_corrigs.pdf
    • https://uploads.strikinglycdn.com/files/5216514d-edc0-44f2-a0d1-dc6fca8e110c/kalulur.pdf
    • http://letonepamusi.pbworks.com/f/learners_licence_test_questions_and_answers_code_10_south_africa.pdf
    • https://uploads.strikinglycdn.com/files/9ca5cd2f-b7f1-4823-b105-9575c66203ef/how_to_lower_metabolic_acidosis.pdf
    • http://xedidovetaw.pbworks.com/w/file/fetch/144425985/twas_the_night_before_christmas_old_book.pdf
    • http://luwivaj.pbworks.com/f/bissell_proheat_12_amp_carpet_cleaner_instructions.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e436.bin
b87e8f42d99750390a4778c407084ca250cde74ec9b105445fbd068bdc59aaad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE436 5356 bytes
font_01_sfnt_off0000f65c.bin
341c2028a3cde39b2f71c8b50b115d333791ac1a061ae507004397e1b1ff746f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF65C 11096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.