Malicious PDF — malware analysis report

Static analysis result for SHA-256 c99669618973dca4…

MALICIOUS

PDF

76.9 KB Created: 2021-03-07 14:15:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7fe67763107e475ea9d7326b58f03e35 SHA-1: 7ad10149afb79c20b094387dbac41cc91ba3c552 SHA-256: c99669618973dca4f11e6f7453f170f2c9272d9bc1553c77fd6f1c2ae8ecf25f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'the living bible app for android', directing the user to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=the+living+bible+app+for+android
    • https://cdn-cms.f-static.net/uploads/4381766/normal_604339ae64974.pdf
    • http://xawegap.mywebcommunity.org/irregular_verbs_in_the_preterite_practice.pdf
    • http://pegajopakazo.22web.org/darth_revan_event_swgoh_guide.pdf
    • https://cdn-cms.f-static.net/uploads/4407807/normal_600e31187c7c8.pdf
    • http://tafakiduwav.scienceontheweb.net/belkin_n600db_wireless_range_extender.pdf
    • http://sokegex.mywebcommunity.org/washington_state_covid_vaccine_eligibility_app.pdf
    • https://cdn-cms.f-static.net/uploads/4485321/normal_601ff17c2c902.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ximuxulizi.myartsonline.com/how_to_change_decimal_places_on_financial_calculator.pdf
    • https://s3.amazonaws.com/tanapilamaxi/70193144757.pdf
    • https://233b4d2f-9c44-4004-b776-098ebc281e6f.filesusr.com/ugd/7f980c_ed5a5abd90564b48a2c2e0e8d7d8530b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d227a3fc-26d0-497c-ad91-b93fd00c6645/norstar_phone_system_feature_codes.pdf
    • http://dumadanovoj.rf.gd/logic_and_contemporary_rhetoric_13th_edition.pdf
    • https://s3.amazonaws.com/jokotaziweluge/37212626303.pdf
    • https://6bb2b61b-82bf-473b-8365-63ddb02ddbdd.filesusr.com/ugd/d55797_ef5473b613b443a89fae5d4bed08e5e8.pdf?index=true
    • https://6b613d20-07f7-402f-9a96-302f7864d873.filesusr.com/ugd/a9248e_a13543cb6bfe4a369c052b95c5619fc3.pdf?index=true
    • https://s3.amazonaws.com/sajatesawodiji/gewolixad.pdf
    • https://d71fc03c-aea6-48f7-a990-8afffb22108d.filesusr.com/ugd/3de8a6_567b574a70644dc1bced491ef5b31133.pdf?index=true
    • https://uploads.strikinglycdn.com/files/274154d4-1167-442d-a4fd-9316947428f5/37692041736.pdf
    • https://0f8fedcd-12c0-4678-86f8-e2bff7269121.filesusr.com/ugd/70e7d4_ace8612a4586409db37d1323aa96fdd7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efe3.bin
f21ceb00174ed9b4365eecf867b0a0effd8da2fc56dbda5ed491cc0af16c5b1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFE3 5276 bytes
font_01_sfnt_off000101d5.bin
e8edcd8ee320d8cdb030736dfe77ea2e473669787c972de4620d53066fea7e93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101D5 10796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.