Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3cabb3c987651e9…

MALICIOUS

PDF

73.8 KB Created: 2021-03-10 14:24:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: aebdb5ebe608ec447ab1fde9a0447ee4 SHA-1: 715296872ae8194bc731f960c748066a862ed240 SHA-256: d3cabb3c987651e962ccf172588a88932481cf44a186ce8a78d4364086306d88
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URI pointing to a suspicious domain, which is likely a lure for downloading malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, contains text related to 'drawing book pdf file free download', reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=drawing+book+pdf+file+free+download PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4393506/normal_6013bba532ab0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371010/normal_5ff409eff277d.pdfIn PDF document text
    • http://reduslim-europa.site/21897028024vwloe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485299/normal_5ff2b11d7aeb0.pdfIn PDF document text
    • http://job-finder.space/nixenozodet3krd7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448121/normal_5fdfae2e5e4d8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366622/normal_5fe52d84acc1a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471514/normal_5fee848b16944.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417429/normal_602b58d836e11.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390637/normal_6021873d89699.pdfIn PDF document text
    • http://my-favshopg.online/how_to_pair_a_universal_rca_remotec7txg.pdfIn PDF document text
    • http://baugroup.info/hello_app_video_kannadam7bwc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478398/normal_5fc596e98a3a9.pdfIn PDF document text
    • http://gufutaca1.xyz/tinus3q99m.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/00b94c21-fa02-4be3-bf86-837a0f9882d5/hoover_spin_scrub_50_parts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ee652a8-11ba-4d40-be0f-77e74ffb22aa/mr_nuts_and_mr_balls.pdfIn PDF document text
    • https://c3438639-6a75-4920-aa4f-d1e0b619354f.filesusr.com/ugd/3be3a7_31cd5c41e9284eb69ba8265fbf5d33d7.pdf?index=trueIn PDF document text
    • https://5c2cca0d-3a4e-48b0-93bf-8ac6c0c026cb.filesusr.com/ugd/271e65_addea670301443bdb938ec64006f848f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/52248790555.pdfIn PDF document text
    • https://8641c524-1fb5-4292-87ed-dd72f64d6c22.filesusr.com/ugd/9b7d8a_4e6f6c199aa14e70a5b3811119eff727.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sugosubexez/zanikakov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3360a6a5-51cf-46b9-b1a4-4cd856db06e1/25249529213.pdfIn PDF document text
    • https://s3.amazonaws.com/godoremitiwuja/calculus_on_manifolds_solutions.pdfIn PDF document text
    • https://s3.amazonaws.com/rawesaragegugar/novujilawe.pdfIn PDF document text
    • https://c8a164a7-2549-4056-b209-d27d417f800b.filesusr.com/ugd/136d3d_10a7a0e56f614f219264accef0fb99c6.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDCD 5328 bytes
SHA-256: cece539e983fbd65cda1efc2c0bea58d3bcdf29b06429999da1868346b86e07e
font_01_sfnt_off0000e016.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE016 10028 bytes
SHA-256: 293e75ca163dfeb3eea266172a43e2f73335e7c5aa7a25835594033bccc211ee
font_02_sfnt_off00010285.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10285 16172 bytes
SHA-256: 7f268005b80ff82e89639affb95403f55eddb42516abbde6a76e27226db124cd

Open this report in the interactive analyzer, or submit your own file for analysis.