Malicious PDF — malware analysis report

Static analysis result for SHA-256 c80b34183c43cbd7…

MALICIOUS

PDF

80.1 KB Created: 2021-04-07 04:20:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47ea52ff2e822218c5f8fedc77db301b SHA-1: b91909f3a33da7ac11a7f9f963aad71d87861aee SHA-256: c80b34183c43cbd7720b04d1120af01cc32322bd5e95d7d38526c25693e2b837
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by heuristics and a machine learning classifier as malicious. The ClamAV detection further confirms its malicious nature, flagging it as a phishing trojan. The document body, though heavily obfuscated, appears to contain text related to programming a remote control, likely a lure to direct the user to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+program+new+directv+remote+rc66rx
    • http://novubelugalij.medianewsonline.com/nijapofititab.pdf
    • http://chistohome.moscow/the_things_they_carried_free_audiobookp8xsv.pdf
    • http://dresdenpharma.ru/what_happens_in_diary_of_a_wimpy_kid_rodrick_rulesdtzvf.pdf
    • http://riwozizedilar.mygamesonline.org/21007904309.pdf
    • http://detonic-official.website/82304387368y88tx.pdf
    • https://cdn.sqhk.co/fuvopone/ihnBuZV/best_solar_power_bank_for_cell_phone.pdf
    • http://magnifioco.site/97583488318i0a8r.pdf
    • https://cdn.sqhk.co/faxotuxoro/MEiipXc/xuzepiped.pdf
    • https://cdn.sqhk.co/vibebexez/uLiflEm/76783557351.pdf
    • http://lilozekakotelup.sportsontheweb.net/agricultural_science_for_jss3.pdf
    • http://alisabor.design/swagbucks_android_app_hackxxmnh.pdf
    • http://mixit.info/18757549909hrc07.pdf
    • http://xitnet.fun/pigatogolozaskmmp.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/96be33ad-09ef-49aa-bedd-b2f85ba8467d/5787289546.pdf
    • https://uploads.strikinglycdn.com/files/83a8fb3c-445b-4d26-9ca1-dddd0903bbd0/what_is_the_power_of_media_and_information_to_affect_change.pdf
    • https://uploads.strikinglycdn.com/files/1119f363-2246-47cf-902f-8eacd6907a2c/mavonexovit.pdf
    • https://uploads.strikinglycdn.com/files/5747cdae-589d-4e3f-8db6-846b74a4df79/descargar_el_hobbit_2_espaol_latino.pdf
    • https://uploads.strikinglycdn.com/files/9ded1cd6-f5eb-4a4d-94ec-3f12b3596c92/what_size_bolts_go_in_the_back_of_a_vizio_tv.pdf
    • https://uploads.strikinglycdn.com/files/20ba4a5a-56f4-491d-8e5b-dc7ab9f5e676/85265851118.pdf
    • https://uploads.strikinglycdn.com/files/1d683a22-a2ea-4bc1-947f-74430c060f4f/sigma_1200_plus_manual.pdf
    • http://xarilupinedup.myartsonline.com/authority_letter_sample.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa36.bin
8a82500c0a600e32ac98102d7404fb2ba21e85fe59f7cab20a20a303e4b9fddf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA36 5516 bytes
font_01_sfnt_off00010cff.bin
06f0e7c695fdc0bec7c4e69f2a795fa59e35ac488b45f5d24fe7b232dd3c2050		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CFF 11060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.