Malicious PDF — malware analysis report

Static analysis result for SHA-256 bada640ba85b8c8b…

MALICIOUS

PDF

72.9 KB Created: 2021-03-28 17:02:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 99aba38c46586cc8a023040014630baa SHA-1: b62f2b5b714aab699479f84b350ae25b834505dd SHA-256: bada640ba85b8c8b5519f92c0fdef9336c6fc11c279a030b11c39b01ef0cb76d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URLs, particularly those with unknown reputations, suggest a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a lure about 'English speaking practice', which is likely a pretext for the malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://allostar.buzz/how_to_connect_jabra_talk_55_to_laptopx02fb.pdf
    • http://vvinorama.website/calories_in_dunkin_donuts_coffee_cake_muffiniutdh.pdf
    • http://checkmycredit.info/804198062649reyt.pdf
    • http://qqkaxes.xyz/dermatology_acne_treatment_guidelinesbtj17.pdf
    • http://idealsit.fun/tapis3bmil.pdf
    • http://lolkek.xyz/don_t_speak_her_name_sheet_musicp780z.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/wb/ENAH/~3/3IgsHNHpEfs/wb?keyword=english%20speaking%20practice%20course%20online%20free
    • http://residarifuwus.rf.gd/fipaxugipebavow.pdf
    • https://a9d1d3ec-13fa-4b7e-abe1-abe2c2ba1301.filesusr.com/ugd/f83029_d467f2d6298c46a4aab491bf58c4f642.pdf?index=true
    • https://28ed73df-463f-41d7-bc87-4635118fd8e0.filesusr.com/ugd/74acc8_3b5de195ef8e4b3c9f07e127fd5a173a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b65d8230-321d-4709-be82-21d84ad408ce/what_is_the_ultimate_goal_of_god.pdf
    • https://uploads.strikinglycdn.com/files/ef1b3a29-946c-44d6-ba9d-110fe0164542/ue_boom_2_waterproof_bluetooth.pdf
    • http://guziruxasa.epizy.com/ihome_wireless_keyboard_manual.pdf
    • https://25f35837-e8ad-4357-b490-8f69bec4165a.filesusr.com/ugd/96c61c_5f0a7e4d032c425fa37f175bcaf3498c.pdf?index=true
    • http://bokonejedebi.rf.gd/zamaxerobexujubasapu.pdf
    • http://joxisuzu.rf.gd/komowiloxokunonoviwakama.pdf
    • https://uploads.strikinglycdn.com/files/50beb28d-66dc-4166-b332-c310a79167c6/how_to_stop_call_forwarding_on_iphone_8.pdf
    • http://tozibuxadotoba.epizy.com/numbered_list_indesign_formatting.pdf
    • https://uploads.strikinglycdn.com/files/025daad5-c541-493a-85e0-36b240d72254/fifty_shades_of_grey_mp3_songs_free_download.pdf
    • http://mixexomamag.rf.gd/androides_dragon_ball_z_fotos.pdf
    • http://xilavugepiw.rf.gd/11533145901.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e086.bin
5e73234d17f70709cb822f8d5dadac97f4d4352a357dc8df10c03114b41b063d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE086 5300 bytes
font_01_sfnt_off0000f290.bin
622f65510bc6642ddb596ecfb33e5c88180b155d88434b016917ab4d5af7c4a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF290 10480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.