Malicious PDF — malware analysis report

Static analysis result for SHA-256 b303a2f9653b64ef…

MALICIOUS

PDF

67.5 KB Created: 2021-02-27 17:01:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f05c85a97c55cca3bf5f517c424e471f SHA-1: 6ef2bee0d40bac7508620556b5f33e578981c23a SHA-256: b303a2f9653b64ef37e573d8729ba8b83e78edecc436ece9bb60fdd87dd04a0f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a heuristic firing for an external URI, specifically pointing to 'https://xezojetit.ru/123?utm_term=where+is+the+closest+dunkin+donuts+to+me'. This URL, combined with the document body text, suggests a phishing attempt disguised as a search query to trick the user into clicking the malicious link. ClamAV detection further supports the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=where+is+the+closest+dunkin+donuts+to+me
    • https://cdn.sqhk.co/juxefirapuf/ia9iahc/personal_obstacles_examples.pdf
    • http://lilubaxubaxulu.sportsontheweb.net/private_peaceful_best_quotes.pdf
    • https://cdn.sqhk.co/xudadidi/qegf7ic/red_robin_order_online_coupon_code.pdf
    • https://cdn.sqhk.co/xolizoxime/ccifji7/pazafub.pdf
    • http://madoxorijegobe.sportsontheweb.net/high-probability_trading_setups_a_chartists_guide_to_real-time_trading.pdf
    • https://dobuwejakunarek.weebly.com/uploads/1/3/4/7/134772316/4359869.pdf
    • http://helplnstagramcontact5087423.com/wahoo_elemnt_bolt_user_guideht4ps.pdf
    • https://xuwosanilenerev.weebly.com/uploads/1/3/4/9/134900173/3719716.pdf
    • http://phtech.site/zombie_hunter_evil_sniper_mod_apkaic7l.pdf
    • https://kojegowi.weebly.com/uploads/1/3/4/6/134685768/0ad10852c.pdf
    • http://lnstagramverifiedbadge-media.com/kapalaposagifdc.pdf
    • http://zupezejukiselu.22web.org/tuworilezimulofatu.pdf
    • https://gedibaforajipet.weebly.com/uploads/1/3/0/8/130874683/xoregadipeg.pdf
    • https://cdn.sqhk.co/fedelubu/jjhhDyJ/novebumenogarowa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nagivozuzosawax.rf.gd/57276110858.pdf
    • https://s3.amazonaws.com/rolefosiju/4478474766.pdf
    • http://jupetovujek.epizy.com/64403411270.pdf
    • https://s3.amazonaws.com/gomaxod/ponte_retificadora_kbpc5010_datasheet.pdf
    • https://s3.amazonaws.com/kulinisokakewi/bodaton.pdf
    • https://s3.amazonaws.com/megelugik/49409053746.pdf
    • http://gigitepusiligo.epizy.com/90180412347.pdf
    • https://s3.amazonaws.com/lixuduwonifa/92281737451.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000caa1.bin
2f7786d5b1fe27a58e3f492340a7878483ee3a546029ac321515d77a3145e001
pdf-font-stream PDF embedded font (sfnt) at offset 0xCAA1 5048 bytes
font_01_sfnt_off0000dbaf.bin
0fc5e3c285c78bc2404f2c77aa470d5a0ddb0c94a01e13ce0aa270ecba9535cd
pdf-font-stream PDF embedded font (sfnt) at offset 0xDBAF 10368 bytes