Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1763f2d206d0952…

MALICIOUS

PDF

73.5 KB Created: 2021-03-19 21:20:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11bcde6aad6b350c5e9ee01206865cd3 SHA-1: 9dc8f2b4fdeb99ba99b9098cbb97dd2af214e1fc SHA-256: b1763f2d206d095216c0c3f755dc800b184ed0bdb5a5e131b7d8177cbff3c3a9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that masquerades as a font download, which is a common lure for phishing attacks. The PDF structure itself also shows signs of manipulation, with duplicate object bodies.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=monopoly+property+cards+font
    • http://medicalpracticementor.com/933916586853u6xe.pdf
    • http://specrazreshenie.com/tone_it_up_app_coupon_code7e9by.pdf
    • https://cdn.sqhk.co/pamavunawi/chcUdjc/30515448466.pdf
    • https://cdn.sqhk.co/morureju/b2gdjhQ/wavurabitiwazopefaxixep.pdf
    • https://cdn.sqhk.co/nobukomorur/iijcX8h/70157946860.pdf
    • http://myirn.icu/1323548550hnoem.pdf
    • https://cdn.sqhk.co/nelufebo/ejhwje5/28552988371.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_fbe6646025fc4c73b0039bb3e2698017.pdf?index=true
    • https://cb47f074-0476-4434-b381-5672a365cab8.filesusr.com/ugd/c46c8a_5210fd680896458e8705a597b21980ff.pdf?index=true
    • http://selafaveso.rf.gd/72878611543.pdf
    • https://s3.amazonaws.com/wuvepilamamuse/jevomomapeviki.pdf
    • https://229c0a76-8cd2-4a6d-ad64-a548a1436bbb.filesusr.com/ugd/f9ed01_85106e880ce5466da40422e563cf552d.pdf?index=true
    • http://rosaboz.rf.gd/body_parts_memory_game.pdf
    • http://kuwalenidil.epizy.com/27768858310.pdf
    • http://motirovaribepok.rf.gd/jeginegigazimaganijefa.pdf
    • https://178fd8f3-986e-459b-a431-83c1f58eadb8.filesusr.com/ugd/7a8e82_c9bcfc22814d4ccaa8a201a44306dcdd.pdf?index=true
    • https://s3.amazonaws.com/wamatasamegu/xalari.pdf
    • http://zutugunosivupa.epizy.com/educational_psychology_books_in_urdu.pdf
    • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_47549127b848436fa935c2e240dea3a4.pdf?index=true
    • https://ba9dc33f-61c2-415e-8598-c57272458a21.filesusr.com/ugd/c05727_7a2cabe68bbe4f798bb63103e07a08b4.pdf?index=true
    • https://1923692e-f727-4f58-80a8-3583160180e3.filesusr.com/ugd/c4ccc4_65dc8a0e9fcf4b289f114b90c622f685.pdf?index=true
    • https://e53c8fcc-339b-4d8f-83f6-44ddc8c6ace4.filesusr.com/ugd/1ea9c4_b12942dce59d4cbbbdbac97c11b77f89.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfb3.bin
da56914603567afa0a9621f508b250856d9a97b2f91248cb532af6e860743620		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFB3 5256 bytes
font_01_sfnt_off0000f1b9.bin
a33f04fc074847204276d3ec9c5ff468e4d3764016024e559ec825234f81acbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1B9 11396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.