Malicious PDF — malware analysis report

Static analysis result for SHA-256 c72f509b9514bec3…

MALICIOUS

PDF

78.7 KB Created: 2021-04-08 01:39:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07d1e67a5974a08e42c6de88ab250a43 SHA-1: d0908e72d153f00a81926414218f382fd480e562 SHA-256: c72f509b9514bec31032822e363324170c90eddac13edecad5aa304489dc62c2
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of external URIs and the 'SE_LOLBIN_RUN_COMMAND' heuristic suggest the document is designed to download and execute further payloads, potentially exploiting vulnerabilities. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'curl_exercise_guide.pdf', hinting at a potential exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=mrs+james+bond
    • https://lowobuganigazo.weebly.com/uploads/1/3/1/1/131163610/xavobadeg_zabilas_jukufuvaw_pomujoni.pdf
    • http://lazujifoxupa.getenjoyment.net/sukax.pdf
    • http://tikopariwoxa.mygamesonline.org/nigabetokapimata.pdf
    • http://busibear.com/planes_y_programas_2011_secundaria_tecnologaerhh9.pdf
    • http://study-english-05.site/what_psi_should_my_pressure_washer_be6psom.pdf
    • https://belexikezetuvom.weebly.com/uploads/1/3/0/7/130775063/muxafaje-vosuzomugop-juvobetupazawor.pdf
    • https://cdn.sqhk.co/wuwexosul/fjgjgjd/saga_of_sultans_download_play_store_app.pdf
    • http://tafugegajotu.mygamesonline.org/bimasodofamezimow.pdf
    • http://lavkavkusa.store/light_novel_overlord_volume_4_bahasa_indonesiaxpsqf.pdf
    • https://cdn.sqhk.co/kugefiruxat/iLherkz/ximolelujovunulolob.pdf
    • https://cdn.sqhk.co/soxoxefumuv/Ggehdhd/basic_sales_and_marketing_skills_list.pdf
    • http://lirinevewafa.mypressonline.com/wubopibozefiwajoguraz.pdf
    • https://vufuredupe.weebly.com/uploads/1/3/0/7/130776381/8600031.pdf
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • https://cdn.sqhk.co/temirikuji/hd0Pxdx/telugu_new_full_movies_free_download_2020.pdf
    • https://cdn.sqhk.co/rixutixim/UvJKWgi/69515511768.pdf
    • https://cdn.sqhk.co/nusatabi/ghhicge/utiitsl_duplicate_pan_card_application_form.pdf
    • http://awpmode.com/pokemon_emerald_guidebookebv50.pdf
    • https://cdn.sqhk.co/soxoxefumuv/Ggeh
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pisik/bawli_tared_song.pdf
    • https://s3.amazonaws.com/zeworibuzoza/hammer_curl_exercise_guide.pdf
    • https://s3.amazonaws.com/nakuzafol/38467466812.pdf
    • https://s3.amazonaws.com/mipizaju/65718915805.pdf
    • http://dajomilot.atwebpages.com/93566719162.pdf
    • https://s3.amazonaws.com/vosimalume/nalidelogekudedazarile.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f610.bin
35d9f00a78c9da4996ce04e9c10bc02908c11840a92b92ed25c1fe1e51ba9c93		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF610 5160 bytes
font_01_sfnt_off00010787.bin
be1030b5116afc38bef3fc7aaeea21a2a5243309beac08da45f29c64e289efee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10787 11240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.