Malicious PDF — malware analysis report

Static analysis result for SHA-256 b367c86277e61e4b…

MALICIOUS

PDF

82.8 KB Created: 2021-03-05 22:25:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 08f7211d732589ed7f50d4e438705d87 SHA-1: 9ae8eeb393698f4bdb2777dc0c92032b0bf5a8a7 SHA-256: b367c86277e61e4b87ef966ea91614feb380d599e854d268ee6c97f3e1ed39e4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely as part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. No scripts were extracted, but the presence of external URIs and the overall detection suggest a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=finnegans+wake+lyrics+clancy+brothers
    • http://velesvoyage.ru/foam_sheet_art_projects1n6z9.pdf
    • http://opsnatur.fun/8720050837505dyd.pdf
    • http://shoop-fe.ru/cisco_ccnp_route_practice_examekt5p.pdf
    • http://rutefozur.22web.org/bionic_commando_game_free_for_pc.pdf
    • http://talemine.getenjoyment.net/hampton_bay_ac-552_replacement_blades.pdf
    • http://fipixavonusin.iblogger.org/dijamojobenodajimufoweton.pdf
    • http://dudisukogonox.iblogger.org/77405437730.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6dd2d9ca-5d95-4b5a-b9d7-63cc3c0f6cec/what_is_the_best_shampoo_for_extremely_oily_hair.pdf
    • http://fijinibegomiba.rf.gd/25426122754.pdf
    • https://44034db3-6cdd-4729-adf3-7ccd6afcf354.filesusr.com/ugd/9fe9cc_71a22ddd156b42a09d8a2837cdd0e276.pdf?index=true
    • http://rexelipenaporux.rf.gd/22951238632.pdf
    • https://uploads.strikinglycdn.com/files/15dd3e05-6b34-4631-9525-339b0e35bf26/36560622506.pdf
    • https://uploads.strikinglycdn.com/files/a8937143-1a26-448a-baf3-49de6be1a7bb/laxakerenidadolivavuvavex.pdf
    • http://towawemigegi.epizy.com/doxexep.pdf
    • https://uploads.strikinglycdn.com/files/f1cc5952-f9f0-465e-85ce-2425e8e12331/77547830214.pdf
    • http://nadefivetokilak.rf.gd/27027750733.pdf
    • http://xusapibu.onlinewebshop.net/atem_switcher_price.pdf
    • https://fed4949e-3809-4fc0-a28b-84c5d390f589.filesusr.com/ugd/94482e_b5e5c8600d7d481386c781e4a3382150.pdf?index=true
    • https://47c0d0ed-94e3-447f-940a-e265262d053f.filesusr.com/ugd/a43ec6_ea0c91268ffd4ee8a5ae0bef2a8907c3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a510222a-f041-4c25-aefa-41c7e5d3fc07/steve_jobs_net_worth_2019_forbes.pdf
    • http://sikofus.epizy.com/sajilix.pdf
    • http://pudolajuji.atwebpages.com/6437689876.pdf
    • https://03dfb0eb-7fe6-4188-ad87-ea2b88df7b19.filesusr.com/ugd/f967ac_f4c90e060aff44aa959b3dea7c2f0293.pdf?index=true
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_b57a408a9d5b4ddf83998b40b2639f17.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0fc.bin
4f043acb425fc6b01641e58526e7b5f4472a2bac6a71ebd575d9e9adf6d300d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0FC 5412 bytes
font_01_sfnt_off00010382.bin
ca9c8bca39a63a833e3c8e335306398e92761dc7cbc7f7cdf6bd14007b4a30f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10382 10868 bytes
font_02_sfnt_off0001286b.bin
7e63eb3bed9c4ceaf47e86587cf77a789dba98dd2b4db382f0c7f052a0aeb8ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1286B 16160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.