Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca18f276a835d3b2…

MALICIOUS

PDF

77.8 KB Created: 2021-04-21 16:44:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3fd68933c465a6992580ec168f655187 SHA-1: e49d54c072f8d2b1ab17b8113c46976096aad191 SHA-256: ca18f276a835d3b2eaf6a8356099a7f30f7f1bc19d58c8da6378670e1b3e49ed
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing attempt. It contains an embedded URL that, when visited, likely leads to a malicious resource. The document body, though heavily obfuscated, suggests a lure related to printer setup to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=how+to+setup+hp+officejet+pro+8600+scan+to+computer
    • https://static.s123-cdn-static.com/uploads/4455406/normal_5fed5a9ccb5b3.pdf
    • https://static.s123-cdn-static.com/uploads/4489041/normal_5ff689bbe2c98.pdf
    • https://cdn-cms.f-static.net/uploads/4407804/normal_60547787a28d7.pdf
    • https://static.s123-cdn-static.com/uploads/4490122/normal_5fc91060e54ab.pdf
    • https://cdn-cms.f-static.net/uploads/4484115/normal_60353f950aa91.pdf
    • https://cdn-cms.f-static.net/uploads/4374983/normal_60159a5697664.pdf
    • http://xemuzaxu.22web.org/44471189310.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wujafivabipo/old_navy_online_orders_return_to_store.pdf
    • https://s3.amazonaws.com/fokapikow/70361432152.pdf
    • http://zojifupazavigu.epizy.com/skyfire_aroon_raman.pdf
    • https://uploads.strikinglycdn.com/files/7eaa8e2f-0978-4540-a4f6-b92563d4cc1f/zosujudodevibojidosoboxo.pdf
    • https://84d655c4-d84a-4a0c-9c32-0387925bd622.filesusr.com/ugd/6233da_f6ba54001cc14895b0bc0abfa88881fc.pdf?index=true
    • http://tinasixubu.epizy.com/22874843682.pdf
    • https://f867c6cd-7aae-4938-a634-6821dcb48262.filesusr.com/ugd/eb45fa_86d74ffb21c24de481deebd69c9be097.pdf?index=true
    • https://s3.amazonaws.com/zuponefi/51442805689.pdf
    • https://s3.amazonaws.com/budovewesekaz/57402545647.pdf
    • https://uploads.strikinglycdn.com/files/61902a28-0230-4ade-b7ce-df71a77dc760/how_long_can_fleas_live_without_food_or_water.pdf
    • https://b27aca93-056c-4dd2-83a6-fd909c9f709d.filesusr.com/ugd/2ba3ac_bb9cc9c4fdc94220aeec24cd80682f2d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f112.bin
ba47f10a09604763063d144d919e742c94bb16d8ce1ff0adaf96f970e10b6c74		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF112 5840 bytes
font_01_sfnt_off000104ea.bin
073f9e7fd828a6ca263202bdc2794d141b60b59ac1c2cdc0b5dd84efc10926d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104EA 10716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.