Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb16efa744f90a93…

MALICIOUS

PDF

77.4 KB Created: 2021-03-31 15:59:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8901147c50f3f1f5740acdf16865162b SHA-1: aea558d59a287956c63a0d422951086ee44b741c SHA-256: bb16efa744f90a93c03459454d4b2a37226942d5fb6dec75e3c13993f07803a3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to "Buddha quotes tamil pdf", aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=buddha+quotes+tamil+pdf
    • http://bukobaxaz.getenjoyment.net/exploring_christian_theology.pdf
    • https://vinofuloro.weebly.com/uploads/1/3/4/8/134850824/jeguturoduk_zetagawas_rujezufujig_divitujikow.pdf
    • http://cetakchantek.com/mazugumuwime56cf9.pdf
    • https://cdn-cms.f-static.net/uploads/4417992/normal_6052b5c8410b5.pdf
    • https://static.s123-cdn-static.com/uploads/4455174/normal_5fdef0a3951f4.pdf
    • http://xruhdfo.site/9371806235sm59g.pdf
    • https://cdn-cms.f-static.net/uploads/4380403/normal_5fe724d8de20f.pdf
    • https://jamolirotiwe.weebly.com/uploads/1/3/4/6/134693152/rojawekotujokekeba.pdf
    • http://bosuxezaxad.mypressonline.com/marathi_kadambari_free_download.pdf
    • http://discount50it.pro/39778954552vq0c.pdf
    • http://rejemezurufoveg.mywebcommunity.org/nexepubonavorirezi.pdf
    • https://cdn-cms.f-static.net/uploads/4369502/normal_5fdb6faa03e22.pdf
    • http://9gusevshop.website/popular_country_music_artists_2020zaqns.pdf
    • https://vasefifux.weebly.com/uploads/1/3/1/3/131382239/e6f8bb0.pdf
    • http://wujejejifi.mygamesonline.org/what_is_flowchart_explain_its_basic_symbols_with_an_example.pdf
    • https://cdn-cms.f-static.net/uploads/4409246/normal_6061d904607b5.pdf
    • https://static.s123-cdn-static.com/uploads/4388052/normal_6008fb3ef03a6.pdf
    • https://static.s123-cdn-static.com/uploads/4384821/normal_5fcc3c49c774e.pdf
    • http://aycotoro7.xyz/33761100125h0gyz.pdf
    • https://cdn-cms.f-static.net/uploads/4486037/normal_604f2010c7195.pdf
    • http://ruvikuvi.mywebcommunity.org/80647327770.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://23751d96-d7b3-42ca-b8ca-e459b671ea95.filesusr.com/ugd/7de994_a48452b421d44a7198b601c89516256b.pdf?index=true
    • https://beca70af-11ea-46d2-a649-d7fd44c468ee.filesusr.com/ugd/dd41e2_05c7397db398425c87089794dae4765c.pdf?index=true
    • https://e114ad41-1367-46fe-a5fd-427bf640f69d.filesusr.com/ugd/a63c55_e573ea11b6f54a05b5d501811107069f.pdf?index=true
    • https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_41e8d7f12bec464fa57c0c390b079762.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4f2.bin
642f3c7fbd3fb2f48bfd078784624ff88130d01d75f9f6730ccee56806ef24be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4F2 5360 bytes
font_01_sfnt_off0000f70a.bin
e7e294aea1187a64b7a582ffd86dcee427dda8a6287beda49a57b0c88fcd4f6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF70A 3368 bytes
font_02_sfnt_off0001041e.bin
547db5bf8ea49a7476868ad85927e3b884454fd17d083ba21c012fbe2ac11361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1041E 10000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.