Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7134c57ef2a62fb…

MALICIOUS

PDF

78.2 KB Created: 2021-05-06 02:28:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c958e7f20dd5a375b45088f41097831e SHA-1: b9940dc227195fdc9a55d9fbb36e48b69e0e09b8 SHA-256: d7134c57ef2a62fbf56dd0693aa4b1fba59129f86a305752d74f7f243cd2482d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, and numerous other URLs that are likely part of a phishing or malware distribution campaign. The document body, though heavily obfuscated, suggests a lure related to a 'Table of derivatives'. No scripts were extracted, but the presence of external URIs indicates an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=tabela+de+derivadas
    • https://bemesamug.weebly.com/uploads/1/3/4/7/134722017/viliwedepotemenuzaze.pdf
    • http://wezotodatixazu.iblogger.org/sindhi_to_urdu_dictionary_download.pdf
    • https://nafuxiba.weebly.com/uploads/1/3/4/0/134097784/215996.pdf
    • http://about-central.com/kagugivabererifakidatababqbr9p.pdf
    • http://dimax-matrasy.ru/20190017064mybu9.pdf
    • http://heleogose.online/citizen_eco_drive_skyhawk_wr200_blue_angels_manualcuzqy.pdf
    • http://wibimozuj.22web.org/naruto_online_android_app.pdf
    • https://nojamatisi.weebly.com/uploads/1/3/1/3/131384142/zejijixegafe.pdf
    • https://kelogukagikuval.weebly.com/uploads/1/3/0/7/130739039/tixirudusuzipe_kakopevoxarate.pdf
    • http://3203epworthcres.com/how_to_find_a_picture_of_a_house_by_address55odd.pdf
    • http://bcpreactiva-enlinea.com/kogamahjtji.pdf
    • http://brosbass.com/pijimalenagajewulurizolnv116.pdf
    • http://powerpoint4you.ru/how_to_calculate_the_length_of_a_side_of_a_triangle_using_trigonometrytcg61.pdf
    • http://hotita.space/66146319770btrob.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/watajive/13810848539.pdf
    • https://s3.amazonaws.com/kobivimelelo/23221774520.pdf
    • https://s3.amazonaws.com/bejexe/eric_foner_give_me_liberty_chapter_15_outline.pdf
    • http://neloronubu.epizy.com/clasificacion_de_los_bienes_y_servicios_economicos.pdf
    • https://s3.amazonaws.com/mokixetat/muwitosapaxuz.pdf
    • http://junedujivoxoz.epizy.com/back_pain_exercises_arthritis_uk.pdf
    • https://s3.amazonaws.com/gofiguj/horton_hears_a_who_full_movie_free_youtube.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8a7.bin
8ed69f81d375eb9f29ac5ca30ff6a2714620fccf2df1fa62689807eafbdca15f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8A7 4968 bytes
font_01_sfnt_off0000e999.bin
ccb3796bf2b1b86d91eeb8d7e35e8675c13228e81e2777e40f00c6c9543a388f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE999 13388 bytes
font_02_sfnt_off00011391.bin
f21b10eaccd50fe9ea9dbaa3188c6de9ead411111f49e327ea475e1dbfd2c92d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11391 16264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.