Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4da47105cbb83e6…

MALICIOUS

PDF

76.4 KB Created: 2021-03-14 22:31:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1797ffeb27f7ea03fbc25fed7a8b5970 SHA-1: d498beb744fbbf2331b20b091768761c51d77f31 SHA-256: d4da47105cbb83e6e85e68c8d9901d215dde7ac61f36fbca7569b2e27d52d5c6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to 'dafemum.ru', which is likely a malicious domain used to host or redirect to a phishing page. The document body, though heavily obfuscated, suggests a lure related to a 'night owl 16 channel dvr manual pdf', aiming to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=night+owl+16+channel+dvr+manual+pdf
    • http://fb-copyright-help-from.com/what_do_i_do_if_my_roku_remote_wont_pair1dv5l.pdf
    • http://4d-5d.com/descargar_striker_soccer_america_2015r5mqq.pdf
    • http://joxitikoki.getenjoyment.net/benedetto_xvi_libri.pdf
    • http://vetebozo.mypressonline.com/what_are_the_main_five_languages_of_love_test.pdf
    • https://static.s123-cdn-static.com/uploads/4451932/normal_5ffe5887915eb.pdf
    • https://static.s123-cdn-static.com/uploads/4412768/normal_5fdf335334f66.pdf
    • http://legiontry.online/tagaxewofidovologifa59qs.pdf
    • http://wativeb.mypressonline.com/fesebanegademudexipusoji.pdf
    • http://lebizifijafaxim.medianewsonline.com/client_services_manager_job_description.pdf
    • http://suwefazimim.medianewsonline.com/55714551547.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://miwewugewu.atwebpages.com/michael_crichton_timeline_summary.pdf
    • https://uploads.strikinglycdn.com/files/68f3fceb-4a5d-46ec-a142-a939511f3926/orbit_57896_6-station_manual.pdf
    • https://4590046d-f0a9-4171-b8a0-56ff8c1fe63c.filesusr.com/ugd/0bfb20_c22fbe89853a4580bbb73fff5bf083d2.pdf?index=true
    • https://e8677ced-6330-435e-8237-200fb10408a4.filesusr.com/ugd/a4c1fa_e0c3959a428e41e69fc738c813ac1089.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bf203e8b-7480-4bbd-bc9f-dd8a1a4710a3/phonological_awareness_activities_for_toddlers.pdf
    • https://4b52a32b-134a-4729-a2b8-f16537e28c4f.filesusr.com/ugd/738632_183fd75e539d4b64b7e2e52fc9c3ffd9.pdf?index=true
    • http://zikoliduxa.atwebpages.com/92979079804.pdf
    • https://368af19b-b9be-4417-8ea7-dfc4611f9fec.filesusr.com/ugd/abd4c0_328e085a39094280b805dcae3480a574.pdf?index=true
    • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_8a0f6879a4a049f0b70dd16d25faa629.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec17.bin
1c6354e363355d3b4ca23bc41bf5d48edb71ad3b42d792093b58f339f46efa7e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC17 5720 bytes
font_01_sfnt_off0000ff8c.bin
56d90e3eee4583c7cf19643f8a1485333085236aeac03821b8f44153341209fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF8C 10644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.