Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2d81b8709bfc0a6…

MALICIOUS

PDF

68.4 KB Created: 2021-04-06 07:39:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8d4bc893e398fed05c5299df9485bf82 SHA-1: 3a00e7c5d56a58c4fac446d479198fbf7f72dcd0 SHA-256: c2d81b8709bfc0a67475d8f54f57d086e7b55759d15115cf35935e3a2944d16d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, one of which is presented in the document body as a 'millermatic 130xp parts diagram' to entice clicks. The presence of embedded URLs suggests an attempt to redirect the user to a malicious site, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=millermatic+130xp+parts+diagram
    • http://padlamadla.site/gsheet_query_date22gl8.pdf
    • http://zoompol.xyz/wakuxonijamoxavatiwosexak78vd9.pdf
    • https://cdn.sqhk.co/biloriput/mgf3Ggh/nufejotikunaduroto.pdf
    • http://pc-remont.website/28765385941n9t0o.pdf
    • https://cdn.sqhk.co/ditamozulipo/hctPHig/18865154830.pdf
    • https://zinaxavum.weebly.com/uploads/1/3/4/3/134354277/finodo_xagexabixawesel.pdf
    • http://fitokaps.xyz/starting_my_life_with_you_quotesedt79.pdf
    • https://cdn.sqhk.co/jovojatubo/MhgcPge/69446450977.pdf
    • https://fisezogidegogef.weebly.com/uploads/1/3/2/3/132303301/govisutimakisituka.pdf
    • https://wepusiviji.weebly.com/uploads/1/3/4/6/134661614/wamajurepijodivus.pdf
    • https://cdn.sqhk.co/menodotitit/1ibe4hd/basic_elements_of_design_texture.pdf
    • https://cdn.sqhk.co/numobelez/ghfJjh1/lagu_medot_janji_cover_koplo.pdf
    • https://cdn.sqhk.co/rufopunuk/7srjchi/48765197632.pdf
    • http://susobokilodos.iblogger.org/is_the_honest_company_baby_shampoo_safe.pdf
    • https://fufukarebalomok.weebly.com/uploads/1/3/4/3/134352968/rarusisowaxi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f5ff543a-a2d3-4d37-9e52-24b2fc4d33ec/jegoniridaluj.pdf
    • http://zovogimobidel.rf.gd/angular_bootstrap_form_in_modal.pdf
    • https://uploads.strikinglycdn.com/files/4a331b3f-0965-4686-ae5d-a72420b08e14/50937723445.pdf
    • https://uploads.strikinglycdn.com/files/6a3aeb98-e7cd-4e94-a23d-428f2a1fc000/black_no_more_book_summary.pdf
    • http://baromar.epizy.com/vepizoxize.pdf
    • https://uploads.strikinglycdn.com/files/a79e6d03-a025-44e1-99d4-b8163ed64bb1/why_isnt_my_canon_printer_turning_on.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccca.bin
55ceacf0100f7e5e8579a2a4bee5f4c58cd308412fef0bb9a7e275f7c2490852
pdf-font-stream PDF embedded font (sfnt) at offset 0xCCCA 5824 bytes
font_01_sfnt_off0000e095.bin
21f65af1785fedc6da95d20b0016d67dcdf9f91a7230bd49fc1952e73042c0cf
pdf-font-stream PDF embedded font (sfnt) at offset 0xE095 10344 bytes