Malicious PDF — malware analysis report

Static analysis result for SHA-256 d007fbdb581936e2…

MALICIOUS

PDF

75.6 KB Created: 2021-03-24 15:53:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a4115c7dca1b2b836ec0220401d92d85 SHA-1: e393910f8849bcb474c55c8c2b460962e62aa649 SHA-256: d007fbdb581936e2e7ac4b09fb90ddf75865da6047eb446dab68922a4028f0d2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, suggests a lure related to educational content, likely intended to trick the user into visiting the malicious URL for a phishing or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=algebra+2+glencoe
    • http://mubinazo.22web.org/aashiqui_2_movie_video_songs_free.pdf
    • http://logowiwubapokar.iblogger.org/forklift_truck_daily_checklist_template.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://puwekaxaxowiza.epizy.com/carbohydrate_chemistry_and_biochemistry_structure_and_mechanism.pdf
    • http://nozovov.rf.gd/a._m._u_application_form_2019.pdf
    • https://uploads.strikinglycdn.com/files/09c89e5a-a758-484e-af1f-37bc55576c12/what_does_it_mean_when_the_link_light_is_blinking_on_my_modem.pdf
    • http://xuvisoz.epizy.com/21750783339.pdf
    • https://s3.amazonaws.com/nitajosasa/nabojebakegurav.pdf
    • https://uploads.strikinglycdn.com/files/4b2f7eb1-0cc3-463d-b699-2a08d97a3688/jacobsen_mower_parts_dealer_near_me.pdf
    • http://madojizekikozor.epizy.com/boxing_star_hack_apk_mega.pdf
    • https://s3.amazonaws.com/kifutizijebuj/jeffrey_archer_books_mightier_than_the_sword.pdf
    • http://bozonesowozo.epizy.com/nubupafetifeg.pdf
    • http://vodadusilop.rf.gd/voucher_template_d365.pdf
    • https://s3.amazonaws.com/pizivurapab/20974874097.pdf
    • https://s3.amazonaws.com/jadere/13777245097.pdf
    • http://pevivudawof.epizy.com/analog_and_digital_signal_processing.pdf
    • http://zeliganav.epizy.com/39196009513.pdf
    • https://s3.amazonaws.com/galinikagopit/actrapid_penfill_information.pdf
    • http://wabamuvakotobu.epizy.com/bajilugeradevik.pdf
    • https://uploads.strikinglycdn.com/files/481992a3-8ee1-4dc6-bd5e-3a366d8a6ffa/percy_jackson_lightning_thief_book_chapters.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd5e.bin
7f8be8ef1cd6d58c4b788ebc321ef3d7952a17367c624e3d2fde4fec6eda6c6a
pdf-font-stream PDF embedded font (sfnt) at offset 0xDD5E 4708 bytes
font_01_sfnt_off0000ed59.bin
29aefe8164bca8736c3e50209a250863e70ad1122404a392dd59ec28daada62b
pdf-font-stream PDF embedded font (sfnt) at offset 0xED59 10884 bytes
font_02_sfnt_off000111dd.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333
pdf-font-stream PDF embedded font (sfnt) at offset 0x111DD 4324 bytes