Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0a839b5218a5abd…

MALICIOUS

PDF

78.8 KB Created: 2021-05-28 14:50:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d47940a0a7cedd2b234ef39c789b9b0e SHA-1: 5261b2a2c2811d89f989cab5c3dad43501bc3839 SHA-256: c0a839b5218a5abd511b25c002fb741b840665e91f85df562c845d0fcb990616
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL that, when clicked, leads to a domain associated with malicious activity. The document body, though partially corrupted, suggests a lure related to technical support for Xfinity remotes, a common phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=what+to+do+when+xfinity+remote+won%2527t+change+channels
    • https://cdn-cms.f-static.net/uploads/4379603/normal_601321f02a6dd.pdf
    • https://cdn-cms.f-static.net/uploads/4377931/normal_6020bc05df1ca.pdf
    • https://static.s123-cdn-static.com/uploads/4381973/normal_5ffbb53ea3009.pdf
    • https://static.s123-cdn-static.com/uploads/4388062/normal_5fc7a373d1f90.pdf
    • https://cdn-cms.f-static.net/uploads/4416935/normal_6052b019e02b4.pdf
    • https://static.s123-cdn-static.com/uploads/4370560/normal_5fc926175feaa.pdf
    • https://static.s123-cdn-static.com/uploads/4445550/normal_5fcc8d512dc05.pdf
    • https://cdn-cms.f-static.net/uploads/4490122/normal_601ba7a8679c7.pdf
    • https://cdn-cms.f-static.net/uploads/4413243/normal_5fd1e0f2c24f2.pdf
    • https://static.s123-cdn-static.com/uploads/4487424/normal_5fcae4c0ed886.pdf
    • https://static.s123-cdn-static.com/uploads/4367644/normal_5fe08abdc2fb7.pdf
    • https://static.s123-cdn-static.com/uploads/4387825/normal_5fcc643b7640b.pdf
    • https://cdn-cms.f-static.net/uploads/4385230/normal_605d7b21a3e04.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fe6b9404-fd12-41d0-96e9-60dbdbbeaa25/oster_regency_kitchen_center_mixing_bowls.pdf
    • https://uploads.strikinglycdn.com/files/1b44b0c5-3417-44b0-9868-13060c71ed37/logo_modernism_book_free.pdf
    • https://uploads.strikinglycdn.com/files/2de243eb-859c-4d47-9941-edbe8110e4d4/how_to_measure_training_effectiveness_metrics.pdf
    • https://uploads.strikinglycdn.com/files/f4811fa8-1e26-4c32-a1bc-c4c6a5e79ad4/tawilotilotaxozu.pdf
    • https://uploads.strikinglycdn.com/files/b102e7a4-8815-458e-8021-4299d7f95200/xazuferito.pdf
    • https://uploads.strikinglycdn.com/files/6ea051c4-3ced-4b21-8290-90bca6d15a7c/what_was_the_95_theses_written_by_martin_luther.pdf
    • https://uploads.strikinglycdn.com/files/2860e13d-5edc-45e6-a470-9f42242808c8/71052032072.pdf
    • https://uploads.strikinglycdn.com/files/07c84472-1b2d-41ac-9c18-9a02d080454c/jaroslav_seifert_maminka_kniha.pdf
    • https://uploads.strikinglycdn.com/files/869e26d9-2f8e-4836-a63f-5830dedcc52f/xivenuvedaruxisuw.pdf
    • https://uploads.strikinglycdn.com/files/9bcc5648-cbe8-4395-9b8e-6f6ed5fdb43b/private_practice_cast_season_3_episode_16.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f43c.bin
d314629751f5331be3bebac0110466c8698364b3a6190b716594f91afa44bbf7
pdf-font-stream PDF embedded font (sfnt) at offset 0xF43C 5744 bytes
font_01_sfnt_off000107cd.bin
80cd51407b8c1ff4c63a5ad99549ff91e850d6c8be9e26dc5ef39cb47255de1b
pdf-font-stream PDF embedded font (sfnt) at offset 0x107CD 10932 bytes