Malicious PDF — malware analysis report

Static analysis result for SHA-256 b99f6d58085daddd…

MALICIOUS

PDF

91.2 KB Created: 2021-03-10 08:54:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d96c21a50a29ff7ffb722aeef4aaa062 SHA-1: 19520225f5ffac31658fcc63ff941ead616c3432 SHA-256: b99f6d58085daddd3a5b951748a53a224d0f5447ba87c09a3889962db491e54a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URI that points to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains strings that appear to be related to Adobe Illustrator and wkhtmltopdf, suggesting a lure to disguise the malicious nature of the PDF. The presence of external URIs indicates an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=adobe+illustrator+pdf
    • http://balegetiwep.mywebcommunity.org/bsc_physics_hons_syllabus.pdf
    • http://securityverifiedservices.com/27432958945bx7r3.pdf
    • http://lnstagram-verifedbadge.com/55903509350cpo51.pdf
    • https://cdn.sqhk.co/pazaxefuma/gibjgJ0/bitcoin_claim_free_btc_miner_pro_for_pc.pdf
    • https://cdn.sqhk.co/fokofike/hcjjehe/baby_care_kit_with_thermometer.pdf
    • http://wozekozexufoxol.scienceontheweb.net/59369758920.pdf
    • http://usacreditscore.info/kotubuwee09j8.pdf
    • http://keepmaxi.space/why_is_ishmael_important_in_islamjom9z.pdf
    • http://sekelenogake.getenjoyment.net/macbeth_synopsis.pdf
    • http://frontglass.xyz/lazojodijigidetuvunex6h67.pdf
    • https://cdn.sqhk.co/xamizine/GGifhd1/22096775827.pdf
    • https://cdn.sqhk.co/ketalidukepi/X1higgD/maxi_pads_no_wings.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://907864b8-ab38-4b43-b195-7646ee37c451.filesusr.com/ugd/c4b402_85200d72b0034194b422650763017f2f.pdf?index=true
    • https://s3.amazonaws.com/vufuzewasi/42164177641.pdf
    • http://mokupimi.epizy.com/roman_candide_en_arabe.pdf
    • https://a12a05ab-6462-4855-b086-b0a2a961d6d8.filesusr.com/ugd/2c76f4_b3b6151e5ee941459396bd04a700a04d.pdf?index=true
    • https://76bf09fe-c378-4d6f-baa9-beaf48595a8b.filesusr.com/ugd/61567a_37e98d56fb1b4e0393f9d2dcccde5d0a.pdf?index=true
    • https://7980b0ff-2efe-48f4-a442-6c87bca80713.filesusr.com/ugd/9bd8c3_f9be4b7442e844ff9f4678c6e49f5fc7.pdf?index=true
    • http://popewap.epizy.com/dewalt_dw682k_biscuit_joiner_manual.pdf
    • https://s3.amazonaws.com/nuxulikiwab/bubewapaja.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000128a4.bin
5c190f6b09fa3214bfbf985c6d5dab0ba6140d7d028260b1b19bb0df5346cd6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128A4 5164 bytes
font_01_sfnt_off00013a3c.bin
38cea93854a29f6d8beeb28a6a4d556ca39b2383551fc2ce27d69a6c4fbd2839		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A3C 11180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.