Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6254d4ba1735263…

MALICIOUS

PDF

88.3 KB Created: 2021-03-24 06:39:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11ab021dd444a216abab10d13a2841ef SHA-1: 9576d65b1e1b15635d4fe84780431b1a491f9639 SHA-256: d6254d4ba173526382f1b57dad4d0d0ae1de955033bf2fbeb700abb2bae48568
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely contains instructions to open a password-protected archive, a common method to bypass gateway security. The embedded URL 'https://leonvi.ru/wix?keyword=man+leads+woman+follows+everyone+wins+barnes+and+noble' is likely part of the lure or a redirection to a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=man+leads+woman+follows+everyone+wins+barnes+and+noble
    • https://xexigajusotojuz.weebly.com/uploads/1/3/1/6/131606060/lakupadotuziv.pdf
    • https://cdn.sqhk.co/wuvukidovime/fWiiiaT/special_agent_oso_thundersmall_part_1.pdf
    • https://tojemiwavujiguv.weebly.com/uploads/1/3/4/4/134468879/1645104.pdf
    • https://cdn.sqhk.co/kivuwutu/ag3gfTy/xerumijanufabalerifupip.pdf
    • https://cdn.sqhk.co/lopokevofoti/8sImagh/97467318547.pdf
    • http://wusodopepufex.66ghz.com/54158773415.pdf
    • https://cdn.sqhk.co/xezafube/irzhhnx/sas_zombie_assault_4_hacked_ios.pdf
    • https://cdn.sqhk.co/burajugi/jdzhdLh/killer_virus_game_android_free.pdf
    • https://ripufimavewin.weebly.com/uploads/1/3/6/0/136099474/fimuxevifesigaja.pdf
    • https://cdn.sqhk.co/wufevinek/4hfxLhi/zuwuguzoritibusixobufo.pdf
    • http://votubuv.22web.org/slope_intercept_form_graphing_activity.pdf
    • https://cdn.sqhk.co/rapawaferew/bhgjenx/fovajovemowedojodu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/d6b62e45-31cb-47f5-a8cf-e64836556068/depibug.pdf
    • https://uploads.strikinglycdn.com/files/2f814936-15a1-40f9-9764-8cb7caa03b03/is_msm_good_for_your_hair.pdf
    • https://uploads.strikinglycdn.com/files/7515815a-aed4-42c0-917c-567840df9459/48411962036.pdf
    • https://uploads.strikinglycdn.com/files/87f92a9a-96d7-483b-ad57-4b8ac799724f/kavujoxekutopekima.pdf
    • https://uploads.strikinglycdn.com/files/90b18767-266d-4b55-976f-167affe022dc/jazz_guitar_lesson_book.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7e0.bin
e6f2c1c8a0ee67db139abf37ac08c988bc0b7ed505c694e5f1071f9c8e32ec6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7E0 3592 bytes
font_01_sfnt_off0000f4a3.bin
92c674b51ba3f87f5ac67a855676cf68532db17f6ce91eeab8b1a2f6c0f3d306		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4A3 5160 bytes
font_02_sfnt_off00010629.bin
7889f5eaf988e4fd3ad41b47d7fe535fa67f17be943d9e51422d5ef06fcd43ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10629 11696 bytes
font_03_sfnt_off00012e0b.bin
24990b1353011c9a4e42d77d1448e6828bf166cdc4b0fe29f9718f87d4f31013		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E0B 16472 bytes
font_04_sfnt_off00014445.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14445 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.