Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 d64ad38d7de56b35…

MALICIOUS

PDF / .VIR

720.7 KB Created: 2024-01-02 17:04:18 Authoring application: Poppler-utils First seen: 2024-06-27
MD5: fe24547fddf4d8bd02fae3e3399feea2 SHA-1: b2eda8f56cd9ef1e5637da540b8ad06bdd7f6877 SHA-256: d64ad38d7de56b35670bc772c44711e52fb0f4d8c31df8814fc0db94d8c5cb84
74 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript that decodes and references multiple URLs, many of which appear to be redirectors leading to potentially malicious sites. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely for phishing or distributing further malware. The presence of JavaScript indicates an attempt to execute code within the PDF viewer.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4311

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://matritsa-best.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://rajasthanlink.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://damaputulopom.club-directory.com/f/5087 In PDF document text
    • http://www.cmm.com.tw/admin/Portal/LinkClick.aspx?tabid=93&table=Links&field=ItemID&id=340&link=https://portal.wheatonma.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://pezimelote.palsaikbbq.com/f/16792In PDF document text
    • http://www.ville-ge.ch/web-newsletter/newsletter_vdg/go/qui.php?l=728_2577&c=https://ozoltutasi.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xanutefexu.theplazahotelbalanga.com/f/397567639In PDF document text
    • https://lambre.ru/bitrix/redirect.php?goto=https://losaltos.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jewoki.manabi-subete.com/f/719213550In PDF document text
    • http://bangkokaquarium.com/banner.asp?url=https://globairgroup.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jotojorak.salvaralbucardo.com/f/27562876&image=images/banner01.gifIn PDF document text
    • http://www.pekawelding.com/change_language.asp?language_id=th&MemberSite_session=site_2916_&link=https://ruilihomes.com/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://dilel.skyangelus.com/f/9526In PDF document text
    • http://facesitting.biz/cgi-bin/top/out.cgi?id=kkkkk&url=https://mywise.biz/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://wowutalisoferos.thiranmanamalai.com/f/13180In PDF document text
    • https://www.momvideos.su/xxx.php?link=video-bookmark&skip_sell=true&url=https://goingaaa.com/includes/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xamupugafa.club-directory.com/f/9648In PDF document text
    • https://media.russiarunning.com/Culture/SetCulture?culture=ru&returnUrl=https://pensionradvanice.cz/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://meroz.club-directory.com/f/15575In PDF document text
    • http://dommeteens.com/out.cgi?ses=kYgqhtVvzL&id=37&url=https://alibrahimtravel.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://lubapig.palsaikbbq.com/f/68225In PDF document text
    • https://www.practity.com/?download=1&kccpid=591&kcccount=https://nissei-consulting-recruit.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://foxezofenanenuf.sentineltr.com/f/4322In PDF document text
    • http://www.crazies.com/go.php?URL=https://panamaquaticsevents.com/js/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://bewiboxaku.ibcphoenix.com/f/977132501In PDF document text
    • http://kharbit-group.com/Home/ChangeCulture?langCode=ar&returnUrl=https://helpservicesinc.org/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://kurodolegafonom.sharynideas.com/f/68127In PDF document text
    • http://pdsc.lucky-princess.com/search/rank.php?mode=link&id=14&url=https://navarrolowrey.com/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://nezuwe.sentineltr.com/f/84545In PDF document text
    • http://www.paginetessili.it/sponsor.php?sponsor=olea&url=https://5.imimg.com/data5/SELLER/Doc/2024/5/415471825/IN/VY/GI/221250298/f7def162-68e5-450a-bcbd-0b9d0d2e63e8.pdfIn PDF document text
    • https://www.casino-forum.net/redirect-to/?redirect=https://hankilfood.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://jelugod.club-directory.com/f/86831In PDF document text
    • http://libopac.hbcse.tifr.res.in:5000/cgi-bin/koha/tracklinks.pl?uri=https://make.duke.edu/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://geralakuduzexex.gmcalaya.com/f/722477571In PDF document text
    • http://www.y-parts.ru/bitrix/redirect.php?event1=&event2=&event3=&goto=https://midst.sabanciuniv.edu/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://mufutagub.mytickethomeband.com/f/77568In PDF document text
    • https://wnm-group.pl/https://mdphd.ouhsc.edu/cfide/scripts/ajax/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://tusoji.theplazahotelbalanga.com/f/39260/In PDF document text
    • https://djaudits.com/wp-admin/admin-post.php?action=cart_redirected_count&id=77747&url=https://archive.gfjc.fiu.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://fitolisawunub.gmcalaya.com/f/62885&linkCode=ogi&th=1&psc=1In PDF document text
    • http://www.stipendije.info/phpAdsNew/adclick.php?bannerid=129&zoneid=1&source=&dest=https://m3dbcafe.com/sites/all/libraries/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://mazigulaboxulal.salvaralbucardo.com/f/30403In PDF document text
    • https://kazate.octort.co.za/65369769871159264700830869?wenuzumonilekudapufovopikekegupapubune=lawevogetejuradexodugumapuvijusivukugewoguwubimuwowurilutubekelunubonefelukuxijifevadetarobovokuvubelowuzopasujefanibukizulixisufakefuzewofirudidatovekogexinokedekifiwerakasasawixowasirizoferorigexozured&utm_kwd=prefix+and+suffix+lesson+plan+pdf&rufoguribosujexipenuzolekepazezezesita=vesalorowadegulifaxigozevekiwiwodexowugarapokofededanubopidoxumijiwawowuxujowiwasuboxogemefowadegenekudububadozimukawujirowodipewanoxuleribIn PDF document text
    • http://njjgl.com/go.html?url=https://admissions.osu.edu/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://xoxedewigo.mytickethomeband.com/f/55848In PDF document text
    • https://kazate.octort.co.za/65369769871159264700830869?wenuzumonilekudapufovopikekegupapubune=lawevogetejuradexodugumapuvijusivukugewoguwubimuwowurilutubekelunubonefelukuxijifevadetarobovokuvubelowuzopasujefanibukizulixisufakefuzewofirudidatovekogexinokedekifiwerakasasawixowasirizoferorigexozured&utm_kwd=prefix+and+suffix+lesson+plan+pdf&rufoguribosujexipenuzolekepazezezesita=vesalorowadegulifaxigozevekiwiwodexowugarapokofededanubopidoxumijiwawowuxujowiwasuboxogemefowadegenekudububadozimukawujirPDF link annotation
    • https://netmums.digidip.net/visit?url=https://palmettoanimalclinic.com/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://berebo.theplazahotelbalanga.com/f/429007882&ppref=https://www.netmums.com/coffeehouse/drop-clinic-984/weaning-560/&currurl=https://www.netmums.com/coffeehouse/drop-clinic-984/weaning-560/cbb19300-meal-ideas-for-8month-old.htmlIn PDF document text
    • https://globaleducation.agilecrm.com/click?u=https://ajur.rest/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://diwum.mytickethomeband.com/f/662691421In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/rights/Referenced by PDF JavaScript
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000aec32.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000aec32.bin)

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000aec32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAEC32 16972 bytes
SHA-256: d72c86571eb328091d2a4f3902d18994085e086a469ae187380d8d71235ac95b
font_01_sfnt_off000b17cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB17CF 11564 bytes
SHA-256: 97e48f66aef3ba55db9dbfbafdfc3f16c6da2d614e074ef6443f6c3dde4fde19

Open this report in the interactive analyzer, or submit your own file for analysis.