Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3b2b541216915d5…

MALICIOUS

PDF

307.5 KB Created: 2022-06-01 18:11:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2022-07-15
MD5: 70c248b0896a1443006ffb6d7d6e7ab0 SHA-1: 862d098a8a3f71d1b46e0eb4cba3d178b0515b00 SHA-256: c3b2b541216915d50dc22841b8c35a2e8dbd22a7a4cc7039497d9d1823d32713
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file is a PDF containing multiple embedded URLs, one of which, https://lazav.co.za/XSRYdR1H, is flagged as suspicious and likely leads to a phishing or malware distribution site. ClamAV detection and ML classification further support its malicious nature. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external links strongly suggests a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6424

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lazav.co.za/XSRYdR1H?utm_term=worksheet+dna+rna+and+protein+synthesis+answer+key+free+online+courses
    • https://n-tlg.com/files/file/najixuzipenefupovinubo.pdf
    • https://koramuxojenaxer.weebly.com/uploads/1/3/4/7/134701110/gofaja_xijifov.pdf
    • https://callmarkinvestments.fortunekenya.com/callmark/files/sajarodi.pdf
    • http://alvit-bk.ru/userfiles/file/gugabafapijewun.pdf
    • https://polujififodujan.weebly.com/uploads/1/3/4/5/134512681/zosejilukiw.pdf
    • http://tiszaladany.hu/upload/file/14480009251.pdf
    • https://nasoxatexiwek.weebly.com/uploads/1/3/0/7/130739087/livoridiladimiper.pdf
    • https://gozarijaleb.weebly.com/uploads/1/3/4/3/134337750/lotoxis.pdf
    • https://sokudenolojine.weebly.com/uploads/1/4/1/5/141522004/3435690.pdf
    • https://kosusupexe.weebly.com/uploads/1/4/1/4/141442347/75b3dc7d5.pdf
    • http://ephtour.com/FileData/ckfinder/files/20220210_06F58F73D3EC4360.pdf
    • http://netpart.hu/kcfinder/upload/files/woxomurox.pdf
    • https://eltonltd.ru/sites/default/files/uploads/29396612471.pdf
    • https://rovewavulitomu.weebly.com/uploads/1/3/0/8/130873995/biriraf.pdf
    • https://meiontravel.com/UploadFiles/file/20220202014414108.pdf
    • https://jerixexi.weebly.com/uploads/1/4/1/3/141388989/fogepejedenolo_vezepogu.pdf
    • https://bexudedumazises.weebly.com/uploads/1/3/1/4/131406785/2714651.pdf
    • http://www.jindatunnel.com/up_files/file/pujegazaveta.pdf
    • https://xevosafodom.weebly.com/uploads/1/3/4/7/134739965/b80bc7.pdf
    • https://nghiepvu.udicmanpower.vn/uploads/news_file/54288823161.pdf
    • https://roxomutina.weebly.com/uploads/1/3/4/6/134663133/lebimow.pdf
    • https://apapunada.com/contents/files/76496277078.pdf
    • http://nesthomes.in/userfiles/file/fakezaz.pdf
    • https://kusevekusaf.weebly.com/uploads/1/4/1/3/141348410/bixuvikeleji.pdf
    • https://takogazaka.weebly.com/uploads/1/3/4/0/134017011/toxifububolamemobum.pdf
    • https://nogonosexenepe.weebly.com/uploads/1/3/4/6/134674491/pizafo-lajef-sebupenetene-tosiwisa.pdf
    • https://kudaxemukuwofi.weebly.com/uploads/1/3/4/6/134691428/4969460.pdf
    • http://ricettebiagi.it/uploads/assets/file/8211835505.pdf
    • https://wupixizot.weebly.com/uploads/1/3/5/3/135398135/mosefet.pdf
    • https://wobipuferuki.weebly.com/uploads/1/4/1/2/141258080/kuximurusuwe_xaloduxo_debexokabi_bokatabexobisov.pdf
    • http://www.sfainternational.pk/assets/ckeditor/kcfinder/upload/files/pexokarusarugimawon.pdf
    • https://esperanzadeavila.com/fotos/file/67880019939.pdf
    • http://skogsformedling.se/bilder_umeny/File/69450289238.pdf
    • https://harley.dataroom.tw/upload/files/vogulinob.pdf
    • https://bafikesixetiv.weebly.com/uploads/1/3/4/5/134506736/43429c.pdf
    • https://gikotibosad.weebly.com/uploads/1/3/4/3/134332820/b7aa460.pdf
    • http://sangiaodichlaocai.com/upload/image/file/tetowuzaza.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00045b5f.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
pdf-font-stream PDF embedded font (sfnt) at offset 0x45B5F 16792 bytes
font_01_sfnt_off00047376.bin
9a24eccf838c516b1805823ff45536ef079afe4e048788851ef4ee45b4bd1831
pdf-font-stream PDF embedded font (sfnt) at offset 0x47376 11100 bytes
font_02_sfnt_off00048d63.bin
3a25442d4ab84714c75c9e0ea62bb3b37433cb7585fdc97a93e89ff45b3ba5ad
pdf-font-stream PDF embedded font (sfnt) at offset 0x48D63 18324 bytes