Malicious PDF — malware analysis report

Static analysis result for SHA-256 b786a940ccb5905d…

MALICIOUS

PDF

97.6 KB Created: 2021-05-14 02:54:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 9bffb9ae5a075ea31c23b72106e4e607 SHA-1: a9f2950fc131a5f836be8be02501e5e47b754e58 SHA-256: b786a940ccb5905d86b7ade611f19279dc8d9527045803eeb245b0b5259a9bf7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains references to song lyrics and the authoring application, suggesting a lure. The primary IOC is a URL hosted on vilenefex.ru, which is likely used to deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=baekhyun+on+the+road+korean+lyrics PDF link annotation
    • http://xiwupulo.medianewsonline.com/22660662691.pdfIn PDF document text
    • https://cdn.sqhk.co/dosijowikul/0UhhnOy/ansi_ashrae_ashe_standard_170.pdfIn PDF document text
    • http://vozajomaralamer.mygamesonline.org/ancova_example.pdfIn PDF document text
    • https://cdn.sqhk.co/fiwujumejuf/igjftuR/cake_decorating_ideas_simple.pdfIn PDF document text
    • https://cdn.sqhk.co/vopofuxo/ieRGujd/world_war_polygon_mod_apk_revdl.pdfIn PDF document text
    • https://cdn.sqhk.co/wirubetena/fi2lLEQ/el_arte_de_la_guerra_en_espanol.pdfIn PDF document text
    • https://cdn.sqhk.co/mogizilo/Vgehegi/petawuwowuxetanimazorun.pdfIn PDF document text
    • http://fukerijinexin.mygamesonline.org/36768019320.pdfIn PDF document text
    • https://cdn.sqhk.co/xefijumu/gfVZdo7/kickboxing_king_of_prussia_pa.pdfIn PDF document text
    • https://cdn.sqhk.co/xudekutof/fKrgjSh/sinanep.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kotidox/how_do_you_use_fl_studio_20_for_beginners.pdfIn PDF document text
    • https://s3.amazonaws.com/dazinibonofobi/26891174815.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10ce4c5c-38fe-49a1-a6f2-d034d15b4f19/color_theory_and_its_application_in_art_and_design.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20fbe436-2a84-4cc5-9263-8001a6d127f8/83516478985.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fff211de-308e-488c-99c4-88cd788e3d1c/remington_700_223_tactical_barrel_twist.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55250bc3-dc76-49d9-9085-d7edf8f63994/refobidepifujaworilad.pdfIn PDF document text
    • http://bamonoxo.onlinewebshop.net/myers_briggs_test_questionnaire.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a28851b-72d9-4cfc-b036-a6ef477563fa/giduwilosenozojonefikan.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010225.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10225 21068 bytes
SHA-256: 8c97b8f14142d5bf7ef6d0fcba74fa77efa4420183db7d5d5ff8e3f168a7db93
font_01_sfnt_off00014043.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14043 5240 bytes
SHA-256: f7530706eb4e297802b16db210b6c0fe22ec883b6c9353dc888f3269eefa91ea
font_02_sfnt_off00015219.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15219 10772 bytes
SHA-256: 8c67084284748b4c02a3d4c546c65bb42aa26ab606cd47e58a6219167756c7ce

Open this report in the interactive analyzer, or submit your own file for analysis.