Malicious PDF — malware analysis report

Static analysis result for SHA-256 b296c4978b12e292…

MALICIOUS

PDF

90.1 KB Created: 2021-02-20 14:46:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 01c5c9cf6fac440237134c3e137204b8 SHA-1: 9c454721af9665430f1f86c96d651bba2fd56b95 SHA-256: b296c4978b12e292f7dae6cabf3fe5e4eccd522c2f292f3d19447341f7c475cb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high probability of malicious intent. It contains an embedded URI pointing to 'https://jottigo.ru/wix?keyword=datto+leviathan+guide', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though partially corrupted, suggests a lure related to a 'Datto leviathan guide'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=datto+leviathan+guide PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4484363/normal_5fe3380d2a28d.pdfIn PDF document text
    • http://nususolajegak.iblogger.org/40086891155.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453532/normal_5fe65ef220efc.pdfIn PDF document text
    • http://zakukamupavi.22web.org/artritis_idiopatica_infantil.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460983/normal_5fe5fe0d7c8b7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nigowona.rf.gd/gattu_battu_episode_1.pdfIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/watuto.pdfIn PDF document text
    • https://s3.amazonaws.com/gidibesuxi/honda_gc160_pressure_washer_specs.pdfIn PDF document text
    • https://s3.amazonaws.com/xukirizugukugi/letter_u_worksheets_for_pre-_k.pdfIn PDF document text
    • http://rilenipavow.rf.gd/kogozamonopufomelima.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibebulosaxug/fatuwasaroritapegaxapi.pdfIn PDF document text
    • http://nazonuretowu.epizy.com/lsi_logic_sas9260-_8i_manual.pdfIn PDF document text
    • http://wotolag.epizy.com/sozetejubimirevabi.pdfIn PDF document text
    • http://zegemipufe.epizy.com/one_piece_bounty_rush_apk_data_mod.pdfIn PDF document text
    • http://dezezefisimel.rf.gd/guvanarasu.pdfIn PDF document text
    • https://s3.amazonaws.com/lanaladu/62923934451.pdfIn PDF document text
    • http://wegoxoxajenugol.rf.gd/nazara_games_carrom_apk.pdfIn PDF document text
    • http://dotejoxeguni.epizy.com/early_childhood_learning.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012782.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12782 4872 bytes
SHA-256: d83a8d2cea82e651ec647bc4b19cc4403cf3073a03ba082b6d31653b5ba57de1
font_01_sfnt_off00013821.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13821 10200 bytes
SHA-256: a2a8b97c5d05c2b08293aba79e19cade45f3f3228c24cb196a696b7aa40790c5

Open this report in the interactive analyzer, or submit your own file for analysis.