Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1b9d624706a9edf…

MALICIOUS

PDF

87.5 KB Created: 2021-03-27 12:10:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 256bffebb2f3280142c6026cbe886567 SHA-1: e7a457ded621b467ebca0fe155b6bc5705c1e4a3 SHA-256: b1b9d624706a9edf1a3e5002e38116b243d5a2225f3bc026a12bcf2010ad1504
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, appears to reference a vacuum cleaner, suggesting a lure to trick users into clicking the malicious link. No scripts were extracted, but the presence of an external URI in a malicious PDF is a strong indicator of phishing or a scam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=hoover+windtunnel+xl+pet+bagless+upright+vacuum+uh71105di+belt
    • http://xovebud.mygamesonline.org/222194758.pdf
    • http://vertigoa.online/organic_chemistry_book_paula_yurkanis_bruicegkqbx.pdf
    • http://zikewexer.scienceontheweb.net/year_7_algebra_questions_and_answers.pdf
    • http://raicen.com/85147519336ibqab.pdf
    • http://widonatozeg.mypressonline.com/greek_root_words_worksheets_4th_grade.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4455d914-45a1-43f6-8dca-5fa182f59516/how_to_fix_my_samsung_galaxy_s5_black_screen.pdf
    • https://s3.amazonaws.com/wotodedaruzuk/83663633460.pdf
    • https://s3.amazonaws.com/jawusawar/brothers_movie_video_songs_bestwap.pdf
    • https://s3.amazonaws.com/bawalidamovidud/lofowuto.pdf
    • http://ziwebizivag.epizy.com/fowovijitakijamujalulasu.pdf
    • http://lepogulajobuguk.epizy.com/associer_deux_fichier.pdf
    • https://s3.amazonaws.com/kudufigunabi/58863643749.pdf
    • https://uploads.strikinglycdn.com/files/cce93bb6-a7ab-499d-878a-75ff702b4fbf/60389072799.pdf
    • https://s3.amazonaws.com/xedewofuretujo/tojarisutojusetivaxu.pdf
    • https://uploads.strikinglycdn.com/files/ca2ef59c-fdcc-4ee8-a55a-151bffebc882/tapewasipekijizutalaf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000112a7.bin
733a1297f5f9d49436ec6144f663880e275c105e1b2ebcb716ca2770bcebe4d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112A7 6208 bytes
font_01_sfnt_off000127be.bin
61b380a10b62e56166a38ea6de4dd68248e4e09b5a4e7854252d8635c8a6284c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127BE 12088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.