Malicious PDF — malware analysis report

Static analysis result for SHA-256 c900b551096d42be…

MALICIOUS

PDF

82.3 KB Created: 2021-04-12 04:05:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 7fbb2b1ef6ecb942af6c8bdd5fe0031a SHA-1: 205447f9c7c177d9934693a4b4009366b93bb1bd SHA-256: c900b551096d42be34812cb8bd2f102e3b5866b3aea35a11a8ea3f6ad9f68819
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The embedded URL, https://leonvi.ru/strik?utm_term=sat+percent+word+problems+worksheet, is likely used to deliver a secondary payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to educational content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=sat+percent+word+problems+worksheet PDF link annotation
    • http://wivikaxebox.medianewsonline.com/nelasolilugatazamuvam.pdfIn PDF document text
    • http://gegejobusi.22web.org/8721752323.pdfIn PDF document text
    • http://woziwowariv.sportsontheweb.net/afinidad_electronica_unam.pdfIn PDF document text
    • http://xekalabaxuv.medianewsonline.com/bank_clerk_exam_solved_papers.pdfIn PDF document text
    • http://rotawafuwuno.scienceontheweb.net/2687482457.pdfIn PDF document text
    • http://fodadasome.iblogger.org/69954057277.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sefipa/pogajarawisiweg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9ded344-1955-4284-ad01-a93ac4dc4285/what_are_the_five_most_important_rivers_in_new_mexico.pdfIn PDF document text
    • https://s3.amazonaws.com/tevigotu/rajixebupotokade.pdfIn PDF document text
    • http://duvovopuma.epizy.com/relomaropupubifize.pdfIn PDF document text
    • http://jidufapikefufeb.epizy.com/diabetes_in_pregnancy_guidelines_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/timeziso/98704028273.pdfIn PDF document text
    • http://voturugivorajop.onlinewebshop.net/alan_moore_jerusalem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48708224-c04b-4af9-a06c-a732ae2e9c76/things_banned_in_massachusetts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/584813c7-4110-465e-affd-8e9752af66d2/lodata.pdfIn PDF document text
    • http://luturufu.epizy.com/govovuxifuxe.pdfIn PDF document text
    • https://s3.amazonaws.com/wizidimawag/19987912835.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101D4 5712 bytes
SHA-256: a8816620f7c6b23385c3b9982e9ce88d848313e1418a7fa812e48f523717c5a3
font_01_sfnt_off00011522.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11522 11464 bytes
SHA-256: d818325f41f6ab9fab2420c251c15124a5daf541783e53781ebbda8fb061d549

Open this report in the interactive analyzer, or submit your own file for analysis.