Malicious PDF — malware analysis report

Static analysis result for SHA-256 c47f399813152034…

MALICIOUS

PDF

87.6 KB Created: 2021-05-31 17:54:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d0916a889fbd414b796b9e4bd3b22495 SHA-1: 70c5b22a36580971956e9377181954033f4e088f SHA-256: c47f39981315203413505aafe8f0cd0fc58a142482cde57a83ce9d58d4882ce7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'Thap tam thai bao 1982'. No scripts were extracted, but the presence of an external URI strongly suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/pbw?utm_term=thap+tam+thai+bao+1982
    • https://cdn-cms.f-static.net/uploads/4464709/normal_605a5d68dfe9d.pdf
    • https://cdn-cms.f-static.net/uploads/4379477/normal_6047bbd193dd7.pdf
    • https://cdn-cms.f-static.net/uploads/4369766/normal_60462cb8a4c7d.pdf
    • https://static.s123-cdn-static.com/uploads/4460476/normal_600454e8ed1da.pdf
    • https://cdn-cms.f-static.net/uploads/4369796/normal_603f1763c9346.pdf
    • https://static.s123-cdn-static.com/uploads/4503791/normal_5fe597562b71b.pdf
    • https://cdn-cms.f-static.net/uploads/4445104/normal_604d0c031ba49.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/9876f831-2359-4abd-9e7d-2bdc4c9e8efb/arctic_king_8000_btu_air_conditioner_reviews.pdf
    • https://uploads.strikinglycdn.com/files/4b57c5a3-75c9-4891-8f10-97ab4d7b8151/firomogolukebiketigixego.pdf
    • https://uploads.strikinglycdn.com/files/03161ace-645e-4230-8b0c-3b615882a4f7/podefibexora.pdf
    • https://uploads.strikinglycdn.com/files/9e142b2a-de77-46cd-b1c3-ca38f5aadd0c/nouns_exercises.pdf
    • https://uploads.strikinglycdn.com/files/0e76636b-8182-400a-b053-6524208b88de/gukopimamigobuzusasogomad.pdf
    • https://uploads.strikinglycdn.com/files/1344364d-7b99-4b49-83d4-ae76a49d2b46/1182643795.pdf
    • https://uploads.strikinglycdn.com/files/f3241b31-541c-4cf5-a239-104c9dbd734a/clasificacion_de_los_numeros_reales_mapa_mental.pdf
    • https://uploads.strikinglycdn.com/files/94bb82b0-2dee-4e1d-adad-335ea44b2179/options_futures_and_other_derivatives_hull_10th.pdf
    • http://mumubib.pbworks.com/f/diploma_electronics_and_communication_engineering_syllabus.pdf
    • http://bekivuxuga.pbworks.com/f/kotiganajatebizibora.pdf
    • https://uploads.strikinglycdn.com/files/4d83d93c-e639-431f-b27c-2dff3b023410/96884876815.pdf
    • https://uploads.strikinglycdn.com/files/71e3f579-705f-43da-b89f-f629ccb83117/dumbbell_exercises_for_biceps_and_triceps.pdf
    • http://zezimin.pbworks.com/f/farimazaxunakefoju.pdf
    • https://uploads.strikinglycdn.com/files/a0642df2-beaf-4de8-a78c-8e2bda34ff04/how_do_i_reset_the_code_on_my_schlage_lock.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da94.bin
8338b1617b207c78915b83c3d95cde9ecf5e3f361fbfb486e249d1989fd8b6ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA94 4756 bytes
font_01_sfnt_off0000eb1b.bin
bc766048c17b450ac780a121ff09c0b353f8d500d5b71947e4107ec855229eeb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB1B 4940 bytes
font_02_sfnt_off0000fbde.bin
2e133f106b271de92202cde3a1f440388b16b5a9a807a11b34e65185ff8310a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBDE 16872 bytes
font_03_sfnt_off000129f8.bin
15d5a1d63210a2eff4b60039cb9b1e45a1b8b6ffb13477e6e0f20706b20ebf14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129F8 16380 bytes
font_04_sfnt_off00014007.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14007 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.