Malicious PDF — malware analysis report

Static analysis result for SHA-256 d13531c5af17d9db…

MALICIOUS

PDF

87.2 KB Created: 2021-03-14 19:21:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 293459249da373048d050bc30491e327 SHA-1: af315fd03041c6a2426cd2b9943fcf244cf30cde SHA-256: d13531c5af17d9dbda8f67df353c289d1a6acdc36713f5c0f4efdd854eb6572e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that, when clicked, leads to a domain associated with malicious activity. The document body, though heavily obfuscated, suggests a lure related to movie streaming, aligning with phishing tactics. ClamAV detection and ML classification strongly indicate malicious intent, likely to redirect users to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=the+hitchhiker%2527s+guide+to+the+galaxy+movie+streaming
    • https://cdn.sqhk.co/zewesifadeka/Hii64hf/91289110992.pdf
    • https://static.s123-cdn-static.com/uploads/4407749/normal_5ffdb8c2d89df.pdf
    • https://static.s123-cdn-static.com/uploads/4464070/normal_5ffe0e5c96c5d.pdf
    • https://cdn.sqhk.co/lituxopevuk/DjigUcc/mens_hairstyles_short_back_and_sides.pdf
    • https://cdn-cms.f-static.net/uploads/4417025/normal_5fea27858f392.pdf
    • https://static.s123-cdn-static.com/uploads/4408991/normal_5ff560630c98d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sukedil/guided_imagery_exercises.pdf
    • https://s3.amazonaws.com/tawosutosuxi/midabopo.pdf
    • https://s3.amazonaws.com/lorifumofelu/58808588865.pdf
    • https://s3.amazonaws.com/gulapore/97566877956.pdf
    • https://s3.amazonaws.com/muvevanepen/cadena_de_suministro_que_es.pdf
    • https://s3.amazonaws.com/vexosafugunu/guntersville_fishing_report_facebook.pdf
    • https://s3.amazonaws.com/liwafo/the_pit_and_the_pendulum_1991_english_subtitles.pdf
    • https://s3.amazonaws.com/jepinebawo/tokyo_drift_song_masstamilan.pdf
    • https://s3.amazonaws.com/fofeguj/kosifupikoxikonig.pdf
    • https://s3.amazonaws.com/xelimewat/agrobacterium_ti_plasmid.pdf
    • https://s3.amazonaws.com/wumodukubaru/centrale_lille_formation_continue.pdf
    • https://s3.amazonaws.com/xeruxaxer/bifuwolirapavagekadoxoxu.pdf
    • https://s3.amazonaws.com/bezutu/portfolio_website_templates_for_web_developer.pdf
    • https://s3.amazonaws.com/nopomewegobij/58416072763.pdf
    • https://s3.amazonaws.com/fotojipifuzitul/arrest_reports_murphy_nc.pdf
    • https://s3.amazonaws.com/sikuva/nafobeto.pdf
    • https://s3.amazonaws.com/nefagolom/worksheet_2._6_kinematic_equations_answers_key.pdf
    • https://s3.amazonaws.com/dovulavavo/qualified_audit_report_on_going_concern.pdf
    • https://s3.amazonaws.com/jenagubadopi/2020_calendar_template_singapore.pdf
    • https://s3.amazonaws.com/gozilum/kijogojikirofaxil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001148b.bin
7f44a9435c438beae64bd3d32c9f541af67d9813966b8768ce0bddde80238c90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1148B 5632 bytes
font_01_sfnt_off0001279c.bin
c84923628e589d674db9c0481f549efde6f40f5add90b8208a0979a2961b77f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1279C 11580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.