Malicious PDF — malware analysis report

Static analysis result for SHA-256 c215b11cf477e3d8…

MALICIOUS

PDF

78.1 KB Created: 2021-03-31 08:31:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 3ef57dc7996793a15d7813052ddb5a1c SHA-1: d5c4b5ae73e3ea9e5e53203c65bdc9645a93da7f SHA-256: c215b11cf477e3d81166cda3f08f707832f9cce38d94502c2ea31c339ff0de54
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=can+jumper%2527s+knee+go+away PDF link annotation
    • http://tezibif.mygamesonline.org/wojal.pdfIn PDF document text
    • http://numulul.mygamesonline.org/83496724207.pdfIn PDF document text
    • http://biwumani.mywebcommunity.org/83375828446.pdfIn PDF document text
    • http://resokipuga.getenjoyment.net/bacteriological_analytical_manual_download.pdfIn PDF document text
    • http://gavediteriremuv.medianewsonline.com/allosteric_regulation_of_enzyme_activity.pdfIn PDF document text
    • http://laribij.scienceontheweb.net/defending_jacob_novel_by_william_landay_ending.pdfIn PDF document text
    • http://duzusedolatepe.mypressonline.com/nuxodefokovobodoti.pdfIn PDF document text
    • http://forisawidokomor.sportsontheweb.net/challenges_facing_agricultural_sector_in_tanzania.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/sazixipame/callaway_preowned_condition_guide_outlet.pdfIn PDF document text
    • http://xomapagovujux.atwebpages.com/animal_farm_by_george_orwell_movie_download.pdfIn PDF document text
    • https://877305ac-a74e-4e93-918f-f866ec7622df.filesusr.com/ugd/0dac30_14e1b52a81af4ec093c0dd501e88818d.pdf?index=trueIn PDF document text
    • https://97783159-ced7-426e-9fbd-60d2bb3342fb.filesusr.com/ugd/00058f_5546268e0d414f74bb5343f6269e20fd.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/peveziwoguxuzam/51829495709.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxalowafokuvo/bodeforelawovixamu.pdfIn PDF document text
    • https://31f314b5-0768-4c24-bd49-4596ea953b46.filesusr.com/ugd/85a4b1_eeb24197ae4f4ef1a48edcd9917042a3.pdf?index=trueIn PDF document text
    • https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_a7b880e902654441986760ce16a9cf83.pdf?index=trueIn PDF document text
    • https://1c54689f-8f60-44d8-8d81-b144d6ea8ada.filesusr.com/ugd/787b0a_24d0db4af0e447749349b2fdc8feb8eb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/radubozufiwo/how_do_you_solve_gfx.pdfIn PDF document text
    • https://2a1457bb-a4d2-449b-8914-d784a503a6da.filesusr.com/ugd/c0fca2_5c9f3d079e544f96b70833aa10fa0967.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e612.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE612 5252 bytes
SHA-256: 501d0a2168fa12bab26183c493b8f0a166017fd48bd57caa685f7b9777c5fe5b
font_01_sfnt_off0000f7fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7FE 10672 bytes
SHA-256: 092ad12db31ab1fe6ed6efe677104289b4ad2ded565292d38e5fe72f78381b88
font_02_sfnt_off00011c9d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C9D 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.