Malicious PDF — malware analysis report

Static analysis result for SHA-256 c55728764c1bb5e3…

MALICIOUS

PDF

113.5 KB Created: 2021-04-20 15:05:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b65e05f35a49506f3d145ebca77c2fb8 SHA-1: 3a075cee88ccf8cdb8aca73bec7ad95bdff0d23e SHA-256: c55728764c1bb5e35ea76e78e49104f5ee871ae6e71568ff995faf2976f47274
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'musical theatre' to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=key+elements+of+musical+theatre
    • http://mmamba.ru/what_is_negative_interest_rate_meanxsoa4.pdf
    • https://cdn.sqhk.co/jokutevek/xHywgdl/hang_gliding_price.pdf
    • http://zipafaxelati.sportsontheweb.net/97013770134.pdf
    • https://cdn.sqhk.co/bitowiso/ehbjhgi/tobozowo.pdf
    • https://cdn-cms.f-static.net/uploads/4464070/normal_60380d44d3c2c.pdf
    • http://gapilojazixo.getenjoyment.net/94460181478.pdf
    • http://sobozunikira.22web.org/general_banking_act.pdf
    • http://legendbilisim.com/vuteraro98j4.pdf
    • https://cdn.sqhk.co/vonirosidejo/ieRX6B3/jupuzevawutozin.pdf
    • http://vovavipegum.getenjoyment.net/social_contract_theory_of_john_locke.pdf
    • http://unreguezff.rest/frm_mock_exam_2020vdo6z.pdf
    • https://cdn.sqhk.co/lixipadiwel/hfMwzjc/asphalt_6_mod_apk_revdl.pdf
    • http://sogikujuwawim.22web.org/qu_se_puede_comer_cuando_se_tiene_reflujo.pdf
    • https://cdn.sqhk.co/pafevola/hxGje5M/descargar_prop_hunt_portable_apk.pdf
    • http://copyrightshelpscenters.com/catcher_in_the_rye_chapter_summary_2151xf2.pdf
    • https://static.s123-cdn-static.com/uploads/4447436/normal_5ff047f6c585b.pdf
    • http://sodahq.club/itil_service_improvement_plan_templatebyyly.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_28684f12dc3e478ab03d53b6f71abce1.pdf?index=true
    • http://muzowonuneferew.rf.gd/8922692726.pdf
    • http://buvanudune.rf.gd/gedudoxenox.pdf
    • https://aabf49e0-5477-4fd2-8456-a986ef8f2a87.filesusr.com/ugd/9e14ca_84c82d0485ca4fba8d4ee7ea634f7278.pdf?index=true
    • https://170a7d3c-74f0-42f5-9ead-98ae292a4922.filesusr.com/ugd/a18aa6_cfccac5a86d042789d6d69aba2f4d863.pdf?index=true
    • https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_568525fc86c545a1b91e9b458da4cb42.pdf?index=true
    • https://84d51d8d-5932-465a-b044-5d36dace581c.filesusr.com/ugd/98e2de_d39d709c72cf43aa8806021823b3b2f9.pdf?index=true
    • http://gumomexad.onlinewebshop.net/budget_proposal_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018004.bin
6ff652de466d08ccccebda272f469a97fc2eb4979b6944c85365839615f11930		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18004 5192 bytes
font_01_sfnt_off00019193.bin
1a03cc99f01077a7796e7c2f414a6b192610fa6bf613725b446aba860920bdb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19193 11552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.