Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7fce1e3b896ac5d…

MALICIOUS

PDF

68.5 KB Created: 2021-03-05 01:54:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7d5da35ea51160a2bd334c4f3131f00f SHA-1: 1d0acd9f1871353d65828965ed6adea89896459b SHA-256: b7fce1e3b896ac5d2b8f21ee115e174a8803819544e1e224a5148b08417a0395
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though truncated, suggests a lure related to celebrating an anniversary during COVID-19, likely to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=how+to+celebrate+anniversary+during+covid
    • https://static.s123-cdn-static.com/uploads/4466151/normal_600053273a847.pdf
    • https://static.s123-cdn-static.com/uploads/4379230/normal_5ff0e8ea975e1.pdf
    • https://cdn-cms.f-static.net/uploads/4459784/normal_5fd12e19b7d30.pdf
    • https://static.s123-cdn-static.com/uploads/4372382/normal_5fc643e7f1c19.pdf
    • http://tefitagesev.mypressonline.com/vimimoraletopoxowapekokej.pdf
    • http://sowoxapexemex.sportsontheweb.net/la_declaracion_universal_de_los_derechos_humanos.pdf
    • https://static.s123-cdn-static.com/uploads/4489730/normal_5ff30ccc3c82d.pdf
    • https://cdn-cms.f-static.net/uploads/4497110/normal_602454038dc17.pdf
    • http://nibajafij.medianewsonline.com/2011_dodge_avenger_heat_not_working.pdf
    • https://cdn-cms.f-static.net/uploads/4371523/normal_602d941aeac1a.pdf
    • http://sawemawe.mywebcommunity.org/how_to_charge_my_beats_solo_3_wireless.pdf
    • http://bibivire.mygamesonline.org/christian_hindi_prayer_book.pdf
    • http://dekiweragaf.mywebcommunity.org/me_earl_and_the_dying_girl_full_movie_google_drive.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kakasis.onlinewebshop.net/fifty_shades_of_grey_2_ost.pdf
    • https://uploads.strikinglycdn.com/files/1ea863c3-9329-4cc8-9b3c-76a8e46ca72d/roku_xd_remote_not_working.pdf
    • https://uploads.strikinglycdn.com/files/1f7d8cf2-d34e-45f7-8767-9201dac8fb99/norcold_refrigerator_codes_lo_dc.pdf
    • https://uploads.strikinglycdn.com/files/2981907e-03a8-49e8-8308-c8a99dd247ad/hotpoint_gas_stove_igniter_replacement.pdf
    • https://uploads.strikinglycdn.com/files/d9f49d3d-8bf4-428a-81a0-7227372146e6/mitchell_collision_repair_login.pdf
    • https://uploads.strikinglycdn.com/files/289b7f52-9285-498b-8ea8-1ed8bad130d8/intermec_pm4i_not_printing.pdf
    • https://uploads.strikinglycdn.com/files/a2ee01b2-ce56-450c-8899-22a42663778a/48820849073.pdf
    • https://uploads.strikinglycdn.com/files/67004c64-4cf9-4234-a288-d7d990e4297d/44529130147.pdf
    • https://uploads.strikinglycdn.com/files/aa12b621-6030-4670-898b-faa7616e8b78/does_osha_require_a_safety_committee.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf9e.bin
cdfb729eb179025fb75a03efc0276fea25428db9990e8122bf1e5313447285ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF9E 5460 bytes
font_01_sfnt_off0000e256.bin
62909441191d4a44509415a7df902020d2a397fe9558368665194af8e4eca26c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE256 9972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.