Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8b8925ed9753542…

MALICIOUS

PDF

76.3 KB Created: 2021-03-07 04:53:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 62713a1eda919359cb5d6a0f22eb81a7 SHA-1: 7ade1f2c0265a2cce7414559635f2dcf0bc801bd SHA-256: c8b8925ed97535428d1bb7db91965c1be0777b95da0a18179ab063c4ec86513a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is presented as a download link for a specific application. This, combined with the ML classifier and ClamAV detection, strongly suggests a phishing or malware distribution attempt. No scripts were extracted, but the presence of external URIs indicates an attempt to redirect the user to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9583

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=download+jawbone+up2+app
    • http://dozazexopavo.22web.org/maze_runner_tamil_dubbed_movie_free_download.pdf
    • http://jezugelevafebir.22web.org/android_or_iphone_security.pdf
    • https://cdn-cms.f-static.net/uploads/4368951/normal_603a0f11737d6.pdf
    • https://static.s123-cdn-static.com/uploads/4369174/normal_6007ac1e5be25.pdf
    • https://static.s123-cdn-static.com/uploads/4406775/normal_5ff5ac8fa9205.pdf
    • https://static.s123-cdn-static.com/uploads/4402964/normal_5ff9b77a28a3a.pdf
    • https://cdn-cms.f-static.net/uploads/4484623/normal_600c086996109.pdf
    • https://cdn-cms.f-static.net/uploads/4383571/normal_6026e6059f87b.pdf
    • https://cdn-cms.f-static.net/uploads/4427780/normal_5fd805b356b73.pdf
    • https://cdn-cms.f-static.net/uploads/4387922/normal_6036e034a3318.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wupixufekijax/whirlpool_quiet_partner_i_filter_removal.pdf
    • https://uploads.strikinglycdn.com/files/41451270-b57c-4c4c-a080-5b962e0073f4/safety_1st_alpha_omega_3-in-1_car_seat_canada.pdf
    • http://todazanimidut.epizy.com/50465203299.pdf
    • https://uploads.strikinglycdn.com/files/ca93de82-2c8b-4075-b952-08181736940c/how_to_read_wind_load_charts.pdf
    • https://uploads.strikinglycdn.com/files/7ad94114-8437-46c3-9c48-0f10d474b3ea/55488109215.pdf
    • https://uploads.strikinglycdn.com/files/1041339f-84cd-4a33-be07-55feb590575f/dufezato.pdf
    • https://uploads.strikinglycdn.com/files/048136eb-ff96-491e-87ad-40455b7228af/mapupuveb.pdf
    • https://s3.amazonaws.com/xakusineba/xewirinoneranasitun.pdf
    • http://fumorumiseno.epizy.com/sheet_piano_happy_new_year.pdf
    • https://uploads.strikinglycdn.com/files/f00aeee2-13a5-466b-b262-4750dcf6a294/xumujukozogemibew.pdf
    • https://uploads.strikinglycdn.com/files/9f1f24e6-ed17-4e53-b967-a6ac712b85ae/24937812842.pdf
    • https://uploads.strikinglycdn.com/files/995ca72d-60d7-4392-83c8-ceb3fba23e17/the_ancient_secret_of_the_flower_of_life_volume_3_free_download.pdf
    • https://uploads.strikinglycdn.com/files/fb06c1c1-74a0-468d-b043-4669b8bee9fe/63883024923.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5de.bin
d25e262da2cb48084b0fd0d59a92a212ad6b76bf70131b79fc411484047cc7d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5DE 5120 bytes
font_01_sfnt_off00010775.bin
d4306b0dc742a51a85876a050404b6bcfb4c5c0730ae150f51e27cae4427b32a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10775 10912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.