Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba320fbe4cd3d4f1…

MALICIOUS

PDF

66.4 KB Created: 2020-12-03 22:45:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 1a3a514b1a693576935277a56d9de882 SHA-1: 175cb4ca2873c4100efe102d20551cd01d95fba5 SHA-256: ba320fbe4cd3d4f17d5db862699d20bd2ce1a996b960912fb3f324b796914e5e
76 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that points to a suspicious domain, likely serving as a download link for a secondary payload. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggests the document's purpose is to trick the user into believing they need a password to access an archive, a common tactic to evade initial security scans. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=scissor+and+comb+fabric PDF link annotation
    • https://pafudufuwod.weebly.com/uploads/1/3/4/3/134326080/webiz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/miledu/44255716423.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea4c139a-b3c1-4adf-995a-3a4bd562cd7e/iptv_smarters_pr_username_e_a_senha.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2de4c68c-717c-4ebf-b128-e3d6d11b8338/j_cole_no_role_modelz_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/tinezedu/default_date_format_in_phpmyadmin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a4bc543-f0f6-4cb8-8929-e1d199be4005/72216917319.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc558902cf09257bd892bb7/t/5fc8774e094cf7617dc1c29d/1606973263022/94805394005.pdfIn PDF document text
    • https://s3.amazonaws.com/dofufiri/creative_business_card_vector_free.pdfIn PDF document text
    • https://s3.amazonaws.com/vukujidor/top_video_editing_software_for_android.pdfIn PDF document text
    • https://s3.amazonaws.com/kosamupim/25471614265.pdfIn PDF document text
    • https://s3.amazonaws.com/batiku/88381008375.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ebb0bf2-9f1e-411f-9e32-50a5fcee43af/ap_world_history_unit_5_practice_test.pdfIn PDF document text
    • https://s3.amazonaws.com/leguvefu/aerodynamic_aviation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0d13dd4-455e-4426-9091-01ce36c9b67d/2370250485.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0cd9260f2895dc1e75cb0/t/5fc484e44e98326c02a22419/1606714597239/scunci_steamer_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bb99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB99 4968 bytes
SHA-256: 9de8b5fc5116fc37a7d5907eb61ba4a45e57732ae5e48224103931804c1a7734
font_01_sfnt_off0000cc3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC3D 10176 bytes
SHA-256: c24d55b6af9736f22d73f6fd125bd965255dd4b24d72a7bad62f90f4f78fbabe
font_02_sfnt_off0000ef05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF05 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.