Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0d691b2fe50c3d1…

MALICIOUS

PDF

86.0 KB Created: 2021-06-04 16:20:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 3e167ebdb623a7bbd44f67d74614ccb0 SHA-1: efd18e13191b35583eebf0e864dc8cb90d078870 SHA-256: c0d691b2fe50c3d10426aef37ac993b1b9993dac10878dcaecc8eb8922c11ab7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The embedded URL, https://queure.ru/pbw?utm_term=jack+stauber+buttercup+lyrics+youtube, is the primary indicator of malicious intent, likely serving as a lure for phishing or malware distribution. No scripts were extracted, but the presence of an external URI and the overall detection profile strongly suggest a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/pbw?utm_term=jack+stauber+buttercup+lyrics+youtube PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4476123/normal_606e615832ef6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411231/normal_5fd651dd171eb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369793/normal_601eb98f7c3c5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467979/normal_601f32b9d57af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471703/normal_6025cbe9b44b0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452588/normal_600f810750d10.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475208/normal_6026a7a4d9ee4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485457/normal_606bd33a8b6ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450140/normal_604773104f3bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446645/normal_603b71a5da97d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451206/normal_5ff758697c01b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://veniwusuj.pbworks.com/w/file/fetch/144488079/how_to_do_deep_breathing_for_anxiety.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6da499be-7f15-47d4-a77c-27cff01fff25/i_am_from_poem_template_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6c28efe-0cd1-427d-8746-b1e1dda6781b/tawami.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/290e0d48-35e1-4bf2-be6d-6a06317ffe10/black_and_decker_brew_n_go_filter.pdfIn PDF document text
    • http://jujirafamena.pbworks.com/w/file/fetch/144463719/xukonixude.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c5ac711-1326-4bb5-8418-49140b75b72e/25538397869.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fdebe8bc-07f7-497d-a347-1cd34770efe0/cixin_liu_the_three_body_problem_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1185b040-90d0-43a5-82b6-e1fe039f2ac2/17250081333.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3f7f179-c9aa-46b1-a9bb-511f61ae1ba3/nexepegotezekebebomiluf.pdfIn PDF document text
    • http://jajafad.pbworks.com/f/75780547423.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b405969-87ff-4dde-8859-3f3eb6aec437/leyes_laborales_de_puerto_rico.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7edb0be3-8a0a-4870-a5b3-07240c928d29/hp_laserjet_pro_400_mfp_m425dn.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC73 5220 bytes
SHA-256: 780359548393485f38b2f40ed7e191b46efd795cd2ca484b96a552898faf2536
font_01_sfnt_off00010e4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E4D 11472 bytes
SHA-256: d333abf4385d5fdf6cc5143eaef7400dbe61d06d1d579a1bec99877dc7d2b6f9
font_02_sfnt_off00013550.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13550 16192 bytes
SHA-256: b80dcff4b26782ff2bd1ed82e01ce9053ba91b1a5afb9bea673378648d26bec5

Open this report in the interactive analyzer, or submit your own file for analysis.