Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccb1d6b56660755d…

MALICIOUS

PDF

85.8 KB Created: 2021-03-06 05:38:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 88740220d93e7de67621f6c2b493008d SHA-1: 55224489c34af972d0474fc240717524155c11e5 SHA-256: ccb1d6b56660755dd46e0fc904e940d16bb1c40c53ee0d655e88b67f7e70b6d7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by ML classifiers and ClamAV as malicious. The document body, though heavily obfuscated, suggests a lure related to a 'Vampire diaries quiz'. The presence of external URIs indicates an attempt to redirect the user to a potentially malicious site, likely for phishing or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=vampire+diaries+quiz+which+character+would+you+date PDF link annotation
    • http://baltika-trans.ru/mapupurexadexeniwq357l.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453747/normal_5ffe67832dd8a.pdfIn PDF document text
    • http://youtube-subscribes.com/tesis_de_tabaquismo1ja7v.pdfIn PDF document text
    • http://newsportstechnology.ru/buxixikilekidigakau3a6a.pdfIn PDF document text
    • http://easterthjg.com/duvepofupototimaauwgm.pdfIn PDF document text
    • http://vehicleusains.com/a_christmas_carol_1938_full_movie_onlineojbdp.pdfIn PDF document text
    • http://m-laskin.ru/814637386360992t.pdfIn PDF document text
    • http://bioforcecolumbia.site/gegitapotufolimuvejekhnoj2.pdfIn PDF document text
    • http://emmetrix.net/zombie_online_mod_apk_2._27._79z69j.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393632/normal_5ff9dc2db7e80.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476601/normal_5fee4f146ecb9.pdfIn PDF document text
    • http://help-service-support.com/wix_embed_header_code47ufi.pdfIn PDF document text
    • http://myyshooop224.site/deal_of_the_day_amazon_ukam96g.pdfIn PDF document text
    • http://mybiol.site/jam_classic_speaker_wont_turn_onf7ved.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425533/normal_603a90e5890d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408476/normal_5fdac6e623ef8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kiwopusafize/axis_ip_utility_free.pdfIn PDF document text
    • https://s3.amazonaws.com/piwanisaj/jurassic_world_the_game_hack_android_1.pdfIn PDF document text
    • https://s3.amazonaws.com/tumasun/avg_apk_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0fabe29e-ab48-430c-9706-c7674fe53c79/tageligulexo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abeab3de-b6ae-452c-b0b8-93182529d25c/como_se_hace_la_fotografa_documental.pdfIn PDF document text
    • https://s3.amazonaws.com/gosete/jikevabibupiregozo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d20f7b7-d806-44c6-aa99-2913a22fbaf0/miligagiz.pdfIn PDF document text
    • https://s3.amazonaws.com/tumasun/game_catur_online_android_terbaik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5014413-f00a-42c0-b3ec-ebd8733f3ae7/cthulhu_mythos_stories.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ead.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EAD 5648 bytes
SHA-256: b4f4ba20e0e1bbad53f85935414a736183de24997412ccbd23b10a0217af419d
font_01_sfnt_off000121dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121DC 11620 bytes
SHA-256: 1cb957a1e89906a7ee1b5bc955dc65896e9d7cab6b3d0aa7f36ec1c91b88bfce

Open this report in the interactive analyzer, or submit your own file for analysis.