Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce7b92d2b66ef174…

MALICIOUS

PDF

219.6 KB Created: 2021-03-09 06:00:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 1ba41133cfd6add5a6b57e26f47a42e2 SHA-1: c92c5248e81b5d6d70530e1bb3d76f86270e5ec9 SHA-256: ce7b92d2b66ef1741a6e9815ea8ea5e6fa097fbace96cfe58e5097d79441787c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, one of which is `https://mezovuduw.ru/strik?utm_term=warhammer+40k+chaos+daemons+codex+pdf+8th`, suggesting a lure to download content related to popular search terms. No scripts were extracted, but the presence of multiple unknown URLs indicates a likely attempt to redirect the user to a malicious site for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=warhammer+40k+chaos+daemons+codex+pdf+8th PDF link annotation
    • http://qrettalq.online/39418900549iiudd.pdfIn PDF document text
    • https://cdn.sqhk.co/minofavazu/PS4jgPg/eerskraft_apk_download.pdfIn PDF document text
    • http://rezltml.xyz/vinixegegoladuxanogiu4qcs.pdfIn PDF document text
    • https://cdn.sqhk.co/befulirawid/gdhiiig/57522215814.pdfIn PDF document text
    • https://cdn.sqhk.co/pekotegafod/jgUqmhO/soxesoxuvoxawagi.pdfIn PDF document text
    • https://cdn.sqhk.co/fusozuwalas/MWhjgid/hitman_3_release_date.pdfIn PDF document text
    • https://cdn.sqhk.co/patemugimej/Oic3Zjc/84707338266.pdfIn PDF document text
    • http://everydayy.fun/7866422716502b04.pdfIn PDF document text
    • https://cdn.sqhk.co/dovawowo/f5smAhj/soccer_stars_2_player_game.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6d23287f-a15b-43b7-8d69-700c0e01f504.filesusr.com/ugd/185c00_d69d8fc9035a480aab1b4fb4d0860945.pdf?index=trueIn PDF document text
    • https://411be8f8-4ba1-40b5-9edf-cc4a2c3d5ecc.filesusr.com/ugd/a86d68_2387c59103ed4815ab89f2e922590da9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c1172b6-c474-4dd4-b23e-d0f65cf73a81/what_is_police_report_writing_and_why_it_is_important.pdfIn PDF document text
    • https://59548cc9-d6a6-4b2e-bd73-2bfb7290c7b5.filesusr.com/ugd/3fd21f_c63ff8259013451586093d840d33788b.pdf?index=trueIn PDF document text
    • https://48bd7725-9370-4d18-884e-e75d7b70c9c4.filesusr.com/ugd/f241d9_dc7181de07cd459bb42aa9babab7d144.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9cc56aba-6b99-4ce3-9bf3-16c045cb8809/kejumi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2409c8a3-b565-43e3-b0d5-d7f300195df5/hp_laserjet_3055_scanner_driver_for_windows_10_32_bit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000324e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x324E1 5932 bytes
SHA-256: f6281a4d6334809eab0a66365d3ffdd5e216a99d6e41a8b917a8eb6ef22baa64
font_01_sfnt_off00033901.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33901 11772 bytes
SHA-256: 3bfd8945f3dc100511ec3e785de279ad3f1fba1dd1f9c604830b40d00e469751

Open this report in the interactive analyzer, or submit your own file for analysis.