Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb242aa504714d88…

MALICIOUS

PDF

80.9 KB Created: 2021-03-22 12:37:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4bba46d24f3581bf98217c60020688e2 SHA-1: 64af09aee896b9b96fd8a495170522cd742c2cbf SHA-256: bb242aa504714d88d4075890728712e0e270baa781b261df31aa47a31c4804c3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware download site. The document body, though heavily obfuscated, contains keywords related to the URL, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=gentleman+jack+whiskey+cost
    • https://cdn-cms.f-static.net/uploads/4421058/normal_605156df4481c.pdf
    • https://cdn-cms.f-static.net/uploads/4490269/normal_5fe91c0964c18.pdf
    • http://sowopezamiw.medianewsonline.com/how_to_reset_microsoft_edge_password.pdf
    • https://cdn.sqhk.co/vixemujomu/iejeBhb/heye_alchemy_gothic_puzzles.pdf
    • https://static.s123-cdn-static.com/uploads/4421783/normal_5ff45d055728a.pdf
    • http://investmag.org/32042408130oyst2.pdf
    • http://forexgeeks.net/ted_bundy_movie1qg33.pdf
    • https://cdn-cms.f-static.net/uploads/4470542/normal_5fe737ef86416.pdf
    • https://cdn.sqhk.co/pivokazi/1pK7JAn/skyrock_radio_direct_frequence_france.pdf
    • https://cdn.sqhk.co/vedukosamo/hbxqgfq/infectious_mononucleosis_treatment_modalities.pdf
    • http://milanomoda-italy.website/homeostasis_body_systems_worksheetop9u4.pdf
    • https://cdn-cms.f-static.net/uploads/4391599/normal_6045e35006750.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://f55c6975-0091-4942-a106-dc80285e5f9d.filesusr.com/ugd/8a4248_a668db7eb111401a9a550e8d199baa2a.pdf?index=true
    • https://s3.amazonaws.com/xakajoziwibi/vapafofosubulixuxevutojiv.pdf
    • https://70848fb0-0fd0-490a-9360-2ffa38fc212c.filesusr.com/ugd/08e331_d04caf80ed254bdc8abd46f7b4ed2dd2.pdf?index=true
    • https://0443db59-9f9d-4031-b786-8a5723798135.filesusr.com/ugd/ab62d6_4b03a942cbdf4158a1548c536338d22e.pdf?index=true
    • https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_f0470bcd092f408287c07453226c9eaf.pdf?index=true
    • https://s3.amazonaws.com/tirimofufemukat/vorivemuwobulavaraxaxeto.pdf
    • http://sabiwilurase.atwebpages.com/tovug.pdf
    • https://7ae52be2-ba3c-41fb-8935-29281088223e.filesusr.com/ugd/affaa6_ce818e870f7c46f1ad2806fb0283d82d.pdf?index=true
    • https://s3.amazonaws.com/ganubatebedoxez/1693994458.pdf
    • http://sujunutab.atwebpages.com/bratislava_mappa.pdf
    • https://s3.amazonaws.com/tibitexil/blessed_assurance_music_score.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f27b.bin
da0c3c841ebc5750767ab8fba5c1e0ed15e3a2bc533e0938693693a0e723c968		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF27B 5096 bytes
font_01_sfnt_off000103c2.bin
cec78b2968ee524255e421749a70464737c94a60bff5250634c56a741344ff1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103C2 10600 bytes
font_02_sfnt_off00012804.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12804 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.