Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7432578abcd0180…

MALICIOUS

PDF

86.0 KB Created: 2021-03-14 19:22:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: db66c84b5f99d17f9657c30dbef2f998 SHA-1: 29d5ace95225e7fea9c9ff9282a8f2c6ef9d0b5b SHA-256: b7432578abcd018020745286f914402a9b2794ebda1b847014482d6a28dfc4bb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be a lure related to software downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=babbel+full+apk+2019
    • https://cdn.sqhk.co/jabosuve/RjePgjY/dekixega.pdf
    • https://cdn.sqhk.co/digubamot/JnRgeGL/fit_the_fat_2_weight_goal.pdf
    • https://cdn.sqhk.co/xonoguduzob/chjxvih/misupuf.pdf
    • https://cdn-cms.f-static.net/uploads/4417422/normal_5fda87d46d01b.pdf
    • https://cdn-cms.f-static.net/uploads/4505326/normal_602259179f7f7.pdf
    • https://cdn.sqhk.co/pajijolabalu/LhdiSOJ/46470693138.pdf
    • https://cdn.sqhk.co/pananumujo/X2ioifS/7365563504.pdf
    • https://cdn.sqhk.co/nivodoruw/K1jc6on/airplane_crash_movies_on_netflix.pdf
    • https://cdn.sqhk.co/nesadatifu/X4givkz/96753290292.pdf
    • http://copyright-central-media.com/82703912422pml41.pdf
    • https://static.s123-cdn-static.com/uploads/4495058/normal_5fce2b516a782.pdf
    • http://tranquils.space/zosukaqdgl9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c1897723-c218-45c2-b043-2c27c9078215/8887368185.pdf
    • https://6d4cd3b7-91e9-43ac-92b9-205473f1e50d.filesusr.com/ugd/28146e_c4d4b7709bc1407891aa80cd8eaad0ae.pdf?index=true
    • https://uploads.strikinglycdn.com/files/695dfdc8-600e-45c4-a54b-04c40822736c/4_types_of_informational_text_examples.pdf
    • https://48bd7725-9370-4d18-884e-e75d7b70c9c4.filesusr.com/ugd/f241d9_dd24f77fb51a4527bcd3c0f83fc1d3cb.pdf?index=true
    • https://a0d2adcf-75bd-42a9-a42a-c23e1c6e9e1a.filesusr.com/ugd/85c99c_2a60c665c967464992eabf3cd4e07477.pdf?index=true
    • https://uploads.strikinglycdn.com/files/47f7fdd6-5783-45ef-bf26-850bf867ca14/pevunuli.pdf
    • https://9ebe8999-295a-4f11-87dc-c96f3e1b46ff.filesusr.com/ugd/8de238_754606f972124177a55d2e133acd0671.pdf?index=true
    • https://aa6d2f86-95e2-42cc-897e-6bbd71c3a116.filesusr.com/ugd/78daac_33b027a2a29b4c72a5254c2245ce785d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/62646db6-03ae-4e06-a9bc-d915cef842f7/9760941180.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f179.bin
b2630780c82667424ec7da046d9467e89fa4ac2621d6af8ae8009e49e594dd42		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF179 5356 bytes
font_01_sfnt_off000103c9.bin
f3d07ef3d6126f2ce67d58deda836dab53d8897ba8400c2ab7ba54705eebecf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103C9 22304 bytes
font_02_sfnt_off00013532.bin
2c5f1a2e3d9f683f6a217a47aeaaae813f7d4ef732a5ff54a929695507d09140		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13532 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.