Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc450867ca5131ce…

MALICIOUS

PDF

76.3 KB Created: 2021-05-12 23:57:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 859a49ef74be10deec32cb36d4bb599c SHA-1: 94a0803c5d1b36847880e62aa0155dc5833f61e1 SHA-256: cc450867ca5131ce6e030d5276fc36d5109d8f843a95df4166973fbcebc0d601
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and is flagged by ClamAV as a phishing trojan. The ML classifier also strongly indicates maliciousness. The document body, though heavily obfuscated, appears to be a lure related to a physics search query, directing users to a suspicious URL. No scripts were extracted, but the presence of multiple malicious-looking URLs suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=what+is+lattice+in+physics
    • https://cdn.sqhk.co/lufelumad/Phf6gia/midovabixanerim.pdf
    • http://grizhoff.ru/43520797975w8q99.pdf
    • http://jodazok.22web.org/9707292694.pdf
    • http://vekvelo.ru/71358914673o9kry.pdf
    • http://makibazapeti.22web.org/functions_of_the_brainstem.pdf
    • http://kungfumalibu.com/how_to_clear_cfa_level_1rt8r2.pdf
    • https://cdn.sqhk.co/kakovavop/jgh7pjb/busibesudewojuxuveke.pdf
    • https://cdn.sqhk.co/kitujesijak/jblFkig/hair_cut_3d_sound_download.pdf
    • https://cdn-cms.f-static.net/uploads/4530910/normal_606b13deac2ca.pdf
    • https://cdn.sqhk.co/vukixukafoga/6ON6hfM/hp_fortify_static_code_analyzer_user_guide.pdf
    • https://static.s123-cdn-static.com/uploads/4454541/normal_600656efc7143.pdf
    • http://blu-ital.space/sniper_3d_strike_assassin_missionsqknqj.pdf
    • https://static.s123-cdn-static.com/uploads/4471706/normal_5fe12b919bade.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wasekoruwilaf.rf.gd/articulos_sobre_cancer_de_prostata.pdf
    • https://uploads.strikinglycdn.com/files/a13d3c8d-9ef9-4d04-b1a1-e75cf4d9fe40/xugagaledenuwuvaf.pdf
    • http://gedonisezif.epizy.com/all_algebra_formula_file.pdf
    • https://uploads.strikinglycdn.com/files/ea04a79c-0435-4670-b787-425fbdd60804/susan_sontag_notes_on_camp_quotes.pdf
    • http://potolipok.epizy.com/mitosis_and_meiosis_process.pdf
    • https://uploads.strikinglycdn.com/files/b6de405c-8403-48d0-8de8-a5d166140b62/40801071837.pdf
    • https://uploads.strikinglycdn.com/files/aed6a13d-89a0-42a0-b4ed-66c0ec5ee91a/6303928520.pdf
    • http://vadarawofi.epizy.com/ateten_gmlek_kitap.pdf
    • http://kebewuf.rf.gd/disputing_irrational_thoughts.pdf
    • https://uploads.strikinglycdn.com/files/82653d1c-0049-4fe3-ab2c-6c4ff9dea649/tipos_de_sistemas_del_cuerpo_humano.pdf
    • http://wulekugigewipo.epizy.com/celestone_davis_drug_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec7e.bin
204c788b5cdf3a241e7c648380c06541731d0254784d7f9b27972a6ca269011f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC7E 5040 bytes
font_01_sfnt_off0000fdb9.bin
1f843081a86a852b6dde9f8fabc740f4b693acd115588f788f365436e781b87c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDB9 11364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.