Malicious PDF — malware analysis report

Static analysis result for SHA-256 c65cb7979dd7b189…

MALICIOUS

PDF

77.8 KB Created: 2021-03-23 15:01:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c2730ff08a585840ab61e2930f7678ba SHA-1: 57e35318d2a040b64fdd9ce98e425209397e618a SHA-256: c65cb7979dd7b1892ea51eafc963acb869b61ec5797e93806daf5fe7ad81f6a3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text suggesting it is a lure for a specific search query. The primary IOC is an external URI pointing to a suspicious domain, likely intended to host a malicious payload or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=libros+epidemiologia+veterinaria+pdf
    • https://cdn.sqhk.co/zuboxizip/hsgiJot/island_village_montessori_school.pdf
    • https://cdn.sqhk.co/nadoranur/agchhUB/31337360044.pdf
    • http://alcozerox.com/best_way_to_answer_phone_as_a_receptionist7p03c.pdf
    • https://cdn.sqhk.co/wasuxuletiz/aKHk2jj/t_flip_flop_ic_datasheet.pdf
    • https://cdn.sqhk.co/jasamomedam/Ym2WWpp/44984066765.pdf
    • https://cdn.sqhk.co/pevukoza/jcngeib/crazy_bike_racing_stunt_3d_mod_apk.pdf
    • https://static.s123-cdn-static.com/uploads/4472488/normal_5ff40b735a5ed.pdf
    • https://cdn.sqhk.co/xikesurufa/hjdjbic/best_snapchat_filters_to_make_blue_eyes_pop.pdf
    • https://cdn.sqhk.co/sadirurafixi/UKPhbFL/nedopoberipozerel.pdf
    • http://teren.fun/doderokoxulekxroxu.pdf
    • http://sellamorem.com/disenowowimikopomalijzd2uj.pdf
    • https://cdn.sqhk.co/wujejelot/hdCifcH/sawizogilunas.pdf
    • http://eglo.club/garmin_vivofit_jr_2_bands_canadaw60zm.pdf
    • https://cdn-cms.f-static.net/uploads/4374536/normal_602b116639027.pdf
    • https://cdn-cms.f-static.net/uploads/4457279/normal_601d94913fc6a.pdf
    • http://feelslike35.com/starcraft_2_freezing_during_gameplaymtppf.pdf
    • https://cdn.sqhk.co/sanojuxako/w5iaNjh/english_for_beginners_voa_learning_english.pdf
    • https://static.s123-cdn-static.com/uploads/4481068/normal_5ffec06856112.pdf
    • https://cdn.sqhk.co/baluwofuk/cgjjggd/dan_the_man_action_platformer_apk_hile.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/edbabf96-10e6-465b-8808-43d3f66d7743/yufa_chinese_grammar.pdf
    • https://uploads.strikinglycdn.com/files/c7fba441-198a-4029-bf19-d98e271b88c5/45985911242.pdf
    • https://uploads.strikinglycdn.com/files/0460a51d-877f-4767-be5d-f0c1aeb98273/xatelulojipivipelix.pdf
    • https://uploads.strikinglycdn.com/files/dddfe821-fdcb-46af-9d70-871671a04b51/quadra-fire_3100_millennium_wood_stove_price.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9b5.bin
87678c431643b45b8f195dc7095a4a50f4426f75e71f785b6684ec57780d283d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9B5 5500 bytes
font_01_sfnt_off0000fc5c.bin
e8696216337b1edaff282b41a1445991356d2d7790c30c7df0f3602d5b339e51		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC5C 14248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.