Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3a58bf6a80d33ea…

MALICIOUS

PDF

60.7 KB Created: 2020-12-17 06:46:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: cf37fd25f2d196804b60fd60128e07d4 SHA-1: 1b9ceb3c4f292257b5a28a918a3c79a984aca69c SHA-256: c3a58bf6a80d33eac05d73e34d0f696f0a48abe5985e3e8aaa82004d2c9695db
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as a phishing trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to reference a corporate report, suggesting a pretext for the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=casino+guichard-+perrachon+sa+annual+report+2016 PDF link annotation
    • https://sibitolifi.weebly.com/uploads/1/3/4/7/134732274/fopawopefawun.pdfIn PDF document text
    • https://xatawozenovug.weebly.com/uploads/1/3/4/8/134886035/dararasonosafoje.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc328402e537a05ef17c917/t/5fd003b14510f510134adf8a/1607467954419/91570401253.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18e3a065-ce99-4fd1-a43c-fc9bf985ba9b/aztec_medicine_bag.pdfIn PDF document text
    • https://s3.amazonaws.com/rutufokedizon/resebalilujumubuki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6cbd42c-e623-4691-b57c-ca5df099a2ca/ritakiravewamebopelepen.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fcef661deaf7179bbceb462/t/5fd6c88996ed101a3e50596c/1607911563337/char_broil_5_burner_grill_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57784940-7588-4baf-a4cb-8456c82e5c8c/2078061726.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e60b24b06a7eb3ff207b/t/5fc333646457125654a48f9d/1606628198987/shadowrun_5e_sustaining_spells.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2527ce58-793e-4dec-900c-80d61ba89df0/79364749377.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9d8efa2-0604-43aa-a2c8-62aaddac50ec/living_with_himalayan_masters.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5dd7fbda9c57a97e032dc/t/5fce63582fa8bc6bcd1d5e4d/1607361369412/86406165526.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10b9cab79f442f22a6952/t/5fcd1d0f2bc7884852bb8cf6/1607277840152/91525599192.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83bdd131-71f8-495f-adf4-f516f518b5ed/celestia_ludenberg_cosplay_tutorial.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000af72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAF72 5752 bytes
SHA-256: f7ff1a13e3aa6907ef338a96043d778879fe252224abef0f77c85639ce7b9ecb
font_01_sfnt_off0000c307.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC307 10000 bytes
SHA-256: d91565c59da0a7e49773c68cea6d2a7084b2413a6cc6b21544b30fdd47bd01f6

Open this report in the interactive analyzer, or submit your own file for analysis.