Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3472aa16452ee63…

MALICIOUS

PDF

81.8 KB Created: 2021-04-01 13:20:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f2e55acb05b56f2561e52908c836d33 SHA-1: e3418414af596ee5646c8c2d875d6d8620f124fd SHA-256: b3472aa16452ee636e39d9948a884f9972f3db5475494b8d6dcb4e853386e46d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to a movie review.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=a+single+man+2009+movie+review
    • http://nofubajabuv.medianewsonline.com/common_abbreviations_and_acronyms.pdf
    • http://gunenekaroz.mypressonline.com/prayers_against_the_powers_of_darkness_catholic.pdf
    • http://sagedix.medianewsonline.com/miderogukefuxub.pdf
    • http://xoziduso.mypressonline.com/canara_bank_statement_password.pdf
    • http://bimovixexena.scienceontheweb.net/serivavenotag.pdf
    • http://toladidiripe.iblogger.org/nancy_drew_books.pdf
    • http://vudifabofugejij.medianewsonline.com/nilonub.pdf
    • http://jologedeb.getenjoyment.net/watekubodojoxi.pdf
    • http://lomuwugevona.getenjoyment.net/moca_test_scoring.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://493f174a-a540-412c-bacb-e5b7b26cbfcf.filesusr.com/ugd/95bb70_52ebb1b0374c47bf9cc07042a1180c15.pdf?index=true
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_0dca2bdf7ac44bd49385be71934facad.pdf?index=true
    • http://gilaniborifavap.epizy.com/mercury_xr6_150_specs.pdf
    • https://5d9de69b-f80b-44d6-9c2d-9027806fef0b.filesusr.com/ugd/e26ad2_6aaea9e2214e47c1b0a3e8757ad17ec6.pdf?index=true
    • https://217ba8a6-026c-4a9e-b1ce-2eadff0a4a08.filesusr.com/ugd/3d7af5_1094fc9b330045029d6ada55be64911e.pdf?index=true
    • https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_2e9d20c4df1b49538de6fc0ca83136dd.pdf?index=true
    • https://7f1158f2-e44e-4cac-991a-806210d1dc3e.filesusr.com/ugd/e4a8e1_84abeb0fb75e4db19876349b3a9768df.pdf?index=true
    • https://43a98339-0465-49d0-a416-8cef4780896f.filesusr.com/ugd/89258f_54ab46ca0fa04ca5a1335ded6bac5cee.pdf?index=true
    • http://sefowolo.atwebpages.com/52492583512.pdf
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_7fdbd224b8b348998a69888119916160.pdf?index=true
    • https://181f3bdf-810f-4c34-abb3-9f3362228cd6.filesusr.com/ugd/30415f_f94d3e80aa514efd9999be17b831e548.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3b0.bin
42ddeacf6e708f608bb9cd807ba66cd41a5ac92479d05937f86882e7a8e778d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B0 5284 bytes
font_01_sfnt_off0001058a.bin
d830e569736f756ea37f7fdca55372044d45288ea03b77a0704ef06a6240e4ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1058A 11340 bytes
font_02_sfnt_off00012c18.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C18 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.