Malicious PDF — malware analysis report

Static analysis result for SHA-256 cddfe4bbaffcb322…

MALICIOUS

PDF

90.8 KB Created: 2021-03-10 10:44:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 765204931c22d07fd27493cec6325c37 SHA-1: e1f7fb8efbc5d9ddee9ae8652151c20d93a343af SHA-256: cddfe4bbaffcb3225197bde7961da5ab2eb9f7251c037254d1d8185b236410b8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier and ClamAV detection strongly indicate malicious intent. The PDF contains an embedded URI pointing to 'https://leonvi.ru/wix?keyword=ff14+xelphatol+guide+for', which is likely a lure to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to contain metadata related to the PDF creation, further supporting its role as a container for malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=ff14+xelphatol+guide+for
    • https://cdn.sqhk.co/sadopore/hfjjWhd/story_of_a_gladiator_ps4_review.pdf
    • http://teatr-art.com/16094719135mlw7q.pdf
    • https://cdn-cms.f-static.net/uploads/4453560/normal_5fe6e0d3cabbf.pdf
    • https://cdn.sqhk.co/vadetegubufo/mR77ghl/the_silent_age_game_walkthrough.pdf
    • https://viwobatenujaneg.weebly.com/uploads/1/3/4/4/134444739/wagovanerivuf.pdf
    • https://gojenejanoz.weebly.com/uploads/1/3/0/7/130739654/b3bdf727.pdf
    • http://fosipuzo.mypressonline.com/language_development_milestones_18-36_months.pdf
    • https://cdn.sqhk.co/toxotunem/hdWXbif/fokikigowekamen.pdf
    • https://toroborelap.weebly.com/uploads/1/3/4/8/134867907/voxeturarafo_tazarabejekirus_mugabelov.pdf
    • http://xomunuxeju.sportsontheweb.net/85495863779.pdf
    • http://idealica-official-it.website/what_is_sap_hana_cloud_connector_used_forrr4bw.pdf
    • https://static.s123-cdn-static.com/uploads/4392659/normal_60084cf533c3b.pdf
    • https://luragelekow.weebly.com/uploads/1/3/4/3/134377287/vumujog_fajobenoposok_gimamifosaki_kozuwi.pdf
    • https://static.s123-cdn-static.com/uploads/4445125/normal_5ff94295b01c3.pdf
    • https://cdn.sqhk.co/wumidimux/Ogfhiig/video_maker_with_music_and_pictures_download.pdf
    • https://zovuwiveja.weebly.com/uploads/1/3/4/8/134880504/nasugoxeg-daretekokel.pdf
    • https://cdn-cms.f-static.net/uploads/4404745/normal_603be2bfeb68a.pdf
    • http://lukufogud.getenjoyment.net/pobigupeviferor.pdf
    • http://gemubanabugawa.mypressonline.com/seattle_barista_academy_training_manual.pdf
    • http://avit0.pro/instagram_followers_app_apkpurerc6b1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bumurulepowele.myartsonline.com/honda_element_manual_transmission_rebuild_kit.pdf
    • https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_e28c11113cf74c568a108f960f699689.pdf?index=true
    • https://168d2a81-f750-40c6-a653-3787650f980d.filesusr.com/ugd/3bcfef_41f355dee2e643eb9256dc4b035be41d.pdf?index=true
    • https://ef90beaa-bca2-431e-862c-49c19dd94618.filesusr.com/ugd/06497e_410fd6ee5d384cd7907dcc9e7983025e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010aa9.bin
dbf625778edc3479931effbc761a54ff8026a74a5a4c7002268b9be8297c5062		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AA9 5288 bytes
font_01_sfnt_off00011cb4.bin
3cd2d2bbf796d7a9f9401a31e1de7828503d57277c77fc3afa25c04861fb954c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CB4 14100 bytes
font_02_sfnt_off000148b5.bin
ea75db71c9df7250347a03039f742fcd189f5fc3f08964e696816fa8b5227073		 pdf-font-stream PDF embedded font (sfnt) at offset 0x148B5 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.