Malicious PDF — malware analysis report

Static analysis result for SHA-256 c55677f0d577b547…

MALICIOUS

PDF

77.3 KB Created: 2021-05-08 21:20:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: d38976dff2c671fce67fa5561369d5c6 SHA-1: ecbdc659cd273d1832200c5409d7a7cd56bad15a SHA-256: c55677f0d577b547553bc233478cb8b606d0ccd928324855d09c10b3efad2a21
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'fokemale.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to contain text related to programming, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=programming+basics+reddit PDF link annotation
    • http://kujunat.medianewsonline.com/16572025146.pdfIn PDF document text
    • http://wazixusazajafem.22web.org/gazenozifowubepab.pdfIn PDF document text
    • http://fibiver.mygamesonline.org/the_river_radio_station_front_royal_va.pdfIn PDF document text
    • http://zovitidagawas.sportsontheweb.net/67020796006.pdfIn PDF document text
    • http://fasekafalig.scienceontheweb.net/57440375829.pdfIn PDF document text
    • http://bokifov.iblogger.org/bifugutopukurodojig.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/toguvaju/how_to_become_a_real_estate_salesperson_in_the_philippines.pdfIn PDF document text
    • https://s3.amazonaws.com/rovuweraja/oracle_database_sql_certified_expert_certification.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/183a1f5e-5259-4bf4-8df8-893a2fd91667/12640323944.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a627d46-0d61-4f5c-9e8e-78cd06074b02/maths_fast_calculation_tricks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f91caa86-38c3-41fc-861d-e91a7ab995b1/96653570321.pdfIn PDF document text
    • https://s3.amazonaws.com/xubifupi/motorola_cdm1250_accessory_connector_pinout.pdfIn PDF document text
    • https://s3.amazonaws.com/libusamagowuvo/16725266446.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fc315a8-0f08-41e2-8974-b317b54ed315/26548577062.pdfIn PDF document text
    • https://s3.amazonaws.com/mawesenasijoser/94886950796.pdfIn PDF document text
    • https://s3.amazonaws.com/nevowimo/job_interview_questions_and_answers_for_ece.pdfIn PDF document text
    • https://s3.amazonaws.com/rovuweraja/husky_8_gallon_hotdog_air_compressor_parts.pdfIn PDF document text
    • http://ruraduwajisiv.rf.gd/45874534706.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51c0218d-2504-4691-a335-5460649f8186/27128532972.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF5D 5368 bytes
SHA-256: 3e7f87ea87afd726b2f746f419983b16ebb00d3963754498ef4565a455704d72
font_01_sfnt_off00010181.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10181 10940 bytes
SHA-256: b0fc79861b27657ba636b164d686b2a50607cc34c55342e703b2edfbb2dc4ee7

Open this report in the interactive analyzer, or submit your own file for analysis.