Malicious PDF — malware analysis report

Static analysis result for SHA-256 d35249850999ad6b…

MALICIOUS

PDF

107.5 KB Created: 2021-03-26 17:50:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f472478402eef2392290990a7f1931bb SHA-1: 8ec502a63edff986d3f78e0cd31c8a81b0f4e3b4 SHA-256: d35249850999ad6bee769b1a006ed6bacf1a52c71817a21a9e4a3a9f34a370a5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, and ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests malicious intent. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, appears to be a lure related to the 'Bernoulli equation derivation pdf'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=bernoulli+equation+derivation+pdf
    • http://mowefopovog.mywebcommunity.org/17710514852.pdf
    • http://deromgroup.com/molegewutixizulodulaw72qs7.pdf
    • http://santecmb-sarl.com/bapasd9fd1.pdf
    • http://kigurumi.org/81687335329mccpc.pdf
    • http://reduslim-italiaufficiale.site/black_swan_nassim_taleb_audiobookzef2p.pdf
    • http://donbetosstreettacos.com/766551191438uh12.pdf
    • http://remontlegko.info/jiredivasexujiwupatusixo67bm6.pdf
    • http://newsportstechnology.ru/69013188688ed2vs.pdf
    • http://lalashoppen.online/34684758029tmgly.pdf
    • http://shimano-stradic.ru/akhiyon_ka_ye_kajal_ganabpf29.pdf
    • http://arenda-comp.space/3669117125769f4y.pdf
    • http://nunesop.scienceontheweb.net/48811272201.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zijiwaras.onlinewebshop.net/accounting_terms.pdf
    • http://revudipepofaten.myartsonline.com/22062335531.pdf
    • https://s3.amazonaws.com/sazixipame/44653631490.pdf
    • https://s3.amazonaws.com/ladiwuzetawedi/you_dodie_sheet_music.pdf
    • https://1b53f64c-3596-40ff-86ea-95cec8902569.filesusr.com/ugd/838e7e_dbfbce3f7cf04a638567bb20c527014d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/feabbf88-ace3-4598-85e1-08ba69e6b815/fijegunakokulogab.pdf
    • https://uploads.strikinglycdn.com/files/9cf82634-ffd6-4672-be83-51b9027d9cee/best_riding_lawn_mower_for_steep_terrain.pdf
    • https://s3.amazonaws.com/tofizo/52182763719.pdf
    • https://s3.amazonaws.com/fajetufekejo/html_css_and_javascript_projects.pdf
    • https://s3.amazonaws.com/gorajikunobixi/adobe_acrobat_x_standard_update.pdf
    • https://d4180a97-8dd0-4bf1-9e2f-d1b128d1a64d.filesusr.com/ugd/ae059d_6a50cc353c9246d8bcdead3fba1da407.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014b3c.bin
682c8c0d4d6319b13b7f4330de3e2cb426d56792af385ed2d3a75ee3224569ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B3C 5092 bytes
font_01_sfnt_off00015ca7.bin
e33359d74112fe0bfea1800936d22d83b8bb4754b951d02f695c71bbe1809ce6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15CA7 13812 bytes
font_02_sfnt_off00018b3a.bin
6feaaa6c0f30e274cad0d5ddb0a65fea26aee9054bf6f1626384e70618a2d2cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18B3A 16108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.