Malicious PDF — malware analysis report

Static analysis result for SHA-256 d684f6819379497e…

MALICIOUS

PDF

144.1 KB Created: 2021-06-07 11:07:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a37d93cfbd292769441ba73d4d908636 SHA-1: 1f665e49b5c2b561fd64aec09071eb8c9bab3690 SHA-256: d684f6819379497ede149cd3cf04178540ca4cbd1d2b7ef900f74d690cc74af4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. The embedded URLs suggest a phishing or credential harvesting attempt, or potentially a lure to download a second-stage payload. The PDF structure and embedded content are consistent with common techniques used to deliver malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9930

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pedekibitu.weebly.com/uploads/1/3/4/6/134669881/lawudebufi_lepemejovidud.pdf
    • https://wisefumi.weebly.com/uploads/1/3/4/6/134672277/nediv.pdf
    • https://gezixipa.weebly.com/uploads/1/3/4/5/134503119/1876120.pdf
    • https://sifufunozomelu.weebly.com/uploads/1/3/4/7/134764248/xozup.pdf
    • https://setinedib.weebly.com/uploads/1/3/4/6/134684411/29ab8458bfb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://feedproxy.google.com/~r/wb/ENAH/~3/_7yJ53orglQ/wb?keyword=secret%20history%20of%20twin%20peaks%20reddit
    • http://nozobitativi.pbworks.com/f/xibalixotijufagejogobax.pdf
    • http://wabiwepakeg.pbworks.com/f/24048162054.pdf
    • https://uploads.strikinglycdn.com/files/bd93a876-df83-40c8-a99a-95bb359450a2/percy_jackson_graphic_novels_in_order.pdf
    • http://kedetuwi.pbworks.com/f/what_year_4l60e_will_interchange.pdf
    • http://kivupored.pbworks.com/f/30565131455.pdf
    • https://uploads.strikinglycdn.com/files/4b23e47e-eb23-4a65-b633-596a3e73ff83/can_i_share_someones_instagram_post_on_facebook.pdf
    • http://medodadepud.pbworks.com/f/survival_game_jurassic_evolution_world_mod_apk.pdf
    • https://uploads.strikinglycdn.com/files/752fe288-6474-405a-ac50-f216c05886c4/resident_evil_5_save_file_damaged.pdf
    • http://zowonixepor.pbworks.com/w/file/fetch/144459882/minecraft_guide_to_survival_book_big_w.pdf
    • http://gudotoxej.pbworks.com/f/49447327252.pdf
    • http://zowonixepor.pbworks.com/w/file/fetch/144443688/kexomopupinomozosonafab.pdf
    • http://jedilukiwo.pbworks.com/w/file/fetch/144667023/briefly_cite_the_differences_between_ionic_covalent_and_metallic_bonding.pdf
    • http://jajafad.pbworks.com/w/file/fetch/144771255/wowafudomivas.pdf
    • http://mevuteled.pbworks.com/f/30421940786.pdf
    • http://fezosubi.pbworks.com/f/simcity_4_deluxe_edition_download_pc.pdf
    • http://pinurakus.pbworks.com/w/file/fetch/144533037/smart_home_security_systems_nz.pdf
    • http://nipekari.pbworks.com/f/casual_employee_contract_template_free.pdf
    • http://sepaxebi.pbworks.com/f/812184178.pdf
    • http://minuwaxiper.pbworks.com/f/jemopudufejebikomow.pdf
    • http://nunaruribeg.pbworks.com/w/file/fetch/144565761/how_do_i_reset_my_dikang_infrared_thermometer.pdf
    • https://uploads.strikinglycdn.com/files/b90b57a7-65bd-476c-8545-1f7b0670759f/91515285156.pdf
    • https://uploads.strikinglycdn.com/files/6aadab00-4f48-41ea-8284-22afe382d241/78220048081.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001dfc8.bin
69d37b7fed1618161640864ce3a4cb1f4a0cdddca98e06ded40a0d57f473062c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DFC8 5572 bytes
font_01_sfnt_off0001f2d6.bin
83b4bb67eebe9ce118d135abac9040bcc77415a37b6f01e9d60c39f3b2ffe80f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F2D6 12596 bytes
font_02_sfnt_off00021cf4.bin
1621a87b6bc266bc0e3d5871723ec36fa76dd6d2c9fb76f212020cc469043148		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21CF4 16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.