Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8d3f367d8d751c6…

MALICIOUS

PDF

76.3 KB Created: 2021-04-04 01:26:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7bb9bb79b89987fcc86dcdb531c83dea SHA-1: 15e8ed6246155a5558443bcb5c9307fda785e8b0 SHA-256: b8d3f367d8d751c61d16af452d73f04151ccc0fe272208a591621c59a87ef098
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with one specifically referencing an 'award' and 'agriculture fao pdf', suggesting a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URIs are indicative of a phishing or malware distribution campaign, likely leveraging a known exploit or social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7899

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=agriculture+durable+fao+pdf
    • http://cparta.moscow/super_juice_me_28_day_planbpyq6.pdf
    • http://hdsamara.ru/kejukudofenefg61e6.pdf
    • http://secureappeal.com/tapibebagopabobojdvm5.pdf
    • http://lnstagramcopyrightcenter.com/jakugerasedudolinaffbejp.pdf
    • http://kinorio5.xyz/76713648999sehw5.pdf
    • http://meine-gebuhrenfrei.com/dorujuliponi4q0s.pdf
    • http://lowwsaw.xyz/decolonising_the_mind_analysiskpkz3.pdf
    • http://familyit.info/5149302051912ylp.pdf
    • http://fixmarker.fun/hyponatremia_nursing_care_planbeaqp.pdf
    • http://lnstagram-copyright-confirms.com/26022650808zhox.pdf
    • http://lotsmen.com/bolens_tractor_mower_deck_partsjoa6x.pdf
    • http://service-hire.com/philips_tv_appstbsfo.pdf
    • http://proita.fun/magnavox_micromatic_manualya10k.pdf
    • http://sewototenovaro.iblogger.org/94115939957.pdf
    • http://tiktoktop.design/how_to_type_roman_numerals_on_mac_keyboardvzfwp.pdf
    • http://lafovawolifi.22web.org/4837705777.pdf
    • http://sneakerspapa.store/philips_voice_tracer_dvt2510_volume_control3dh5c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_4bf49be95e32427e8cb1df620336584e.pdf?index=true
    • https://s3.amazonaws.com/devuxuzejozam/antivirus_scanner_app.pdf
    • https://s3.amazonaws.com/pewibim/suvoxevikonilox.pdf
    • http://retesatitogeli.epizy.com/zuvelabomegemilopis.pdf
    • https://f8340159-69ce-4309-ac43-521e9a8475b4.filesusr.com/ugd/bc0b97_da679ec99e8e4735be94dd76159db3bb.pdf?index=true
    • https://8458b573-1d6d-478c-912c-b10a972f31df.filesusr.com/ugd/150112_7830d2f7c81a47fd9424b9679c3f74dc.pdf?index=true
    • http://xegiwofune.rf.gd/sunupurazajinitizomuvubeb.pdf
    • https://s3.amazonaws.com/kudufigunabi/what_items_should_not_be_in_a_first_aid_kit.pdf
    • https://s3.amazonaws.com/zarusegibitumet/55397875388.pdf
    • https://6bc61794-ec17-45f1-96eb-8bed4cd57308.filesusr.com/ugd/217b8a_504d6025c36543e29320970b4e74f410.pdf?index=true
    • http://janojunotoz.epizy.com/12th_time_table_2020_commerce_maharashtra_board_download.pdf
    • https://s3.amazonaws.com/jivagajamav/self-reliance_meaning_in_english.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f25e.bin
603046147c828c5eaf8fead47b1a5e195dcd8b7de7b97e8fa5a993eaf624849e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF25E 5272 bytes
font_01_sfnt_off0001045b.bin
f1731ab324db3c2d6a7cde07491ac0813c3df400aa6b785d393a0a67f65b84d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1045B 11776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.