Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc4caaa446710b78…

MALICIOUS

PDF

77.2 KB Created: 2021-03-29 08:39:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0bb815761e964a721842198b748503b5 SHA-1: 7fee9a6518b31187423a08c6e6c56cbbd772b347 SHA-256: cc4caaa446710b78318cd4d03ccfdd8fc4046fdfb9189ab59982b6b085946d17
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to 'https://dafemum.ru/award?keyword=carcassonne+star+wars+english+rules+pdf', which is likely a phishing lure or a distribution point for further malware. No scripts were extracted, but the presence of external URIs and the overall detection suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=carcassonne+star+wars+english+rules+pdf
    • http://design-kvartira.info/xomaxobuduta1iumn.pdf
    • http://prizinsta365.website/pokemon_insurgence_walkthrough9lccc.pdf
    • http://converstarget.ru/pokemon_alola_league_game_gba4thkm.pdf
    • http://visiblawty.com/97517367992oo8pr.pdf
    • http://cenderaoriginator.com/multiplying_and_dividing_scientific_notation_worksheet_easy84snu.pdf
    • http://italia-doc.space/how_to_change_allison_transmission_filter3sj95.pdf
    • http://instapriz.site/602342412cfejh.pdf
    • http://babblescoop.store/less_than_zero_full_movie_onlineqceb5.pdf
    • https://static.s123-cdn-static.com/uploads/4422884/normal_5ff5be9fdbcc0.pdf
    • https://cdn-cms.f-static.net/uploads/4388627/normal_60112bf851b26.pdf
    • http://kudopifupelixi.22web.org/6895789247.pdf
    • http://tofuvuniz.iblogger.org/sefasonezoso.pdf
    • http://letgtma.bid/15941410235jmmnl.pdf
    • http://rapisakaxo.66ghz.com/15379861625.pdf
    • https://cdn-cms.f-static.net/uploads/4385631/normal_604924c674f66.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mokuwanibof/lebuzokijovid.pdf
    • https://s3.amazonaws.com/sezewu/intermolecular_forces_chem_150_activity_answers.pdf
    • https://56a7be67-7dca-40da-a973-69ad719fb73b.filesusr.com/ugd/fedf23_5a74abe694d244b9852fed4b24d6ffe2.pdf?index=true
    • https://s3.amazonaws.com/xeroguru/74999783322.pdf
    • https://68f2566a-c586-4d15-a5d1-3a72044c38f3.filesusr.com/ugd/ecec20_2cb32292a099488bb3a8fc791d9bdd4e.pdf?index=true
    • https://s3.amazonaws.com/faduxodiwo/wexajorakefuxefaniruve.pdf
    • https://d1b33a7b-cde1-45d4-bc15-d4d3b6236ac5.filesusr.com/ugd/1d64af_e3e69c116a6d429bb4183098b1850c3e.pdf?index=true
    • https://s3.amazonaws.com/vebogotexaf/complete_list_of_abstract_nouns.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec08.bin
9891a515c3bbf84109b8b262041b168108c5d79725a85983839d91d46f715f8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC08 5416 bytes
font_01_sfnt_off0000fe79.bin
25012581041a936b996707c279e00f0ca2e1abd81c78e90e8bd4d01686deb0cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE79 11348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.