Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6f7109302a7b1b3…

MALICIOUS

PDF

87.9 KB Created: 2021-04-02 09:06:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7202242de9be42c3fd57523c23da3986 SHA-1: 1d81a9ec05c443e7def5f01c10521ceb09fb3c0a SHA-256: b6f7109302a7b1b3abe957a946f1a4dd4a5c4ca3b058807bb714b7ad9aa0cad7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. The ML classifier and ClamAV detection further support its malicious nature. The document body, though heavily obfuscated, appears to contain metadata related to the PDF creation and potentially a lure related to 'Batman the killing joke movie google drive', suggesting a social engineering tactic to encourage link clicks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=batman+the+killing+joke+movie+google+drive
    • http://pivojowemetobiv.mywebcommunity.org/cmo_ests_de_donde_eres.pdf
    • http://delozofize.scienceontheweb.net/36426583144.pdf
    • https://sinekaku.weebly.com/uploads/1/3/5/9/135964305/9032333.pdf
    • https://cdn-cms.f-static.net/uploads/4416513/normal_602eac17ef945.pdf
    • http://fisujerekuvij.getenjoyment.net/is_there_an_audacity_app_for_iphone.pdf
    • http://tulomodev.getenjoyment.net/acute_acalculous_cholecystitis_review.pdf
    • https://cdn-cms.f-static.net/uploads/4530868/normal_605aba59d45fd.pdf
    • http://paselon.getenjoyment.net/graco_fastaction_fold_jogger_click_connect_travel_system_manual.pdf
    • https://cdn-cms.f-static.net/uploads/4450890/normal_5fe978302b113.pdf
    • http://kujamemapevubu.mypressonline.com/foxegajokumalakutirijuni.pdf
    • https://tumuzisokume.weebly.com/uploads/1/3/5/3/135351536/fe92891.pdf
    • https://veretiwuwe.weebly.com/uploads/1/3/1/4/131406621/somabixibonoge_kitawipaxem_tetenesanode.pdf
    • http://newutatokulu.getenjoyment.net/41734768396.pdf
    • http://pusewuvi.medianewsonline.com/15515449962.pdf
    • https://tofejigijo.weebly.com/uploads/1/3/4/3/134312142/0f35cdc94d8a2ee.pdf
    • https://static.s123-cdn-static.com/uploads/4426557/normal_5fcf6b4453d9a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/wudibirewuduto/free_lesson_plan_templates_for_preschool_teachers.pdf
    • https://s3.amazonaws.com/zaxawetawupo/uncovering_student_ideas_in_primary_science.pdf
    • http://zitasixan.atwebpages.com/complete_information_about_gst.pdf
    • https://s3.amazonaws.com/midaguvimabof/draw_tutorial_step_by_step_easy_for_beginners.pdf
    • https://s3.amazonaws.com/jaloto/gameboy_color_emulator_android_apk.pdf
    • http://womidelere.myartsonline.com/99_names_of_allah_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a0e.bin
dfde1dd9aa620ffbba52adca682e866466645a6a4770f7ffac293514f81c0a7f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A0E 5100 bytes
font_01_sfnt_off00011b32.bin
b04b191971d32cc756f5c6ca990478e0a22a8db4ead70f34e999040871316a4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B32 12168 bytes
font_02_sfnt_off000143d9.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143D9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.