Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5c40e1ac6736cd5…

MALICIOUS

PDF

78.0 KB Created: 2021-06-10 04:29:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 168520df991978dc69e843c9a8c5f0e2 SHA-1: e47db088d35842528d47536ef1b8fd75af365171 SHA-256: d5c40e1ac6736cd5ee72d5d89c18c63854dc5d48298c07ca1fb6a5f5b1405b51
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'pistant.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of embedded URLs suggests a social engineering attempt to redirect the user to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/pbw?utm_term=hotarubi+no+mori+e+full+eng+sub
    • https://ruvavaru.weebly.com/uploads/1/3/0/8/130874457/pirujarelabimav.pdf
    • https://static.s123-cdn-static.com/uploads/4366040/normal_5ffa97d954de7.pdf
    • https://cdn-cms.f-static.net/uploads/4375896/normal_5fd74fc392a00.pdf
    • https://nepufetok.weebly.com/uploads/1/3/1/4/131438640/tiguvodomafumim-pobana-febibatujoja-paragodulegi.pdf
    • https://static.s123-cdn-static.com/uploads/4371004/normal_6004a3fb03dc2.pdf
    • https://static.s123-cdn-static.com/uploads/4489057/normal_5fef7d1e4a58d.pdf
    • https://cdn-cms.f-static.net/uploads/4366365/normal_60692eeb2d4f3.pdf
    • https://cdn-cms.f-static.net/uploads/4378379/normal_602d935af16a4.pdf
    • https://static.s123-cdn-static.com/uploads/4417805/normal_5ff267749f752.pdf
    • https://cdn-cms.f-static.net/uploads/4471704/normal_5fe75a11f3b5f.pdf
    • https://static.s123-cdn-static.com/uploads/4413223/normal_5fcecee01d9e5.pdf
    • https://cdn-cms.f-static.net/uploads/4378160/normal_605f77a1ca523.pdf
    • https://static.s123-cdn-static.com/uploads/4459654/normal_5fe302ace7db4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nikekuva.pbworks.com/w/file/fetch/144581889/how_to_descale_a_nespresso_lattissima_touch.pdf
    • https://uploads.strikinglycdn.com/files/75ee32da-8b85-4cc9-9adb-4c5a76753463/can_you_donate_couches_to_salvation_army.pdf
    • https://uploads.strikinglycdn.com/files/bd4995a5-bd49-4b78-a612-5ddb6978fcd4/xemejegurutinejajojamede.pdf
    • http://zupelapowi.pbworks.com/w/file/fetch/144498177/fc_barcelona_vs_real_madrid_4-0_2016.pdf
    • http://pikalunik.pbworks.com/w/file/fetch/144692658/coreldraw_suite_8_serial_number.pdf
    • http://poxanoralanu.pbworks.com/f/aksara_jawa_lengkap_dengan_pasangan_dan_sandhangan.pdf
    • http://rimikupababo.pbworks.com/f/where_is_my_mind_drum_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/f4098a3e-8083-48da-8bf0-2fb5a78e5233/investing_all_in_one_for_dummies_reddit.pdf
    • https://uploads.strikinglycdn.com/files/4a8d25a4-31cf-4740-be8b-e7eab633641c/how_to_cut_stone_backsplash.pdf
    • https://uploads.strikinglycdn.com/files/32f4da5f-f4e7-460d-8915-04776bccf9cd/11384917512.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7a6.bin
a8bb295adce06666852798224f8c17cf63d4c16f7697ae4b42c723da0a07d689		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7A6 3028 bytes
font_01_sfnt_off0000f282.bin
b1f34ef22275f5d1cebab90b631c85aafd3e39f8d63129dde44dabf59408f768		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF282 5188 bytes
font_02_sfnt_off00010414.bin
e48cc299f72e95ec6f35d85b7b0965cad2db5a789e8ff89002840221539bf126		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10414 11400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.