Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7b20f8eaefb03d8…

MALICIOUS

PDF

76.4 KB Created: 2021-03-05 18:08:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b998d48ff9bbe984e33e33683f11c23b SHA-1: d15d442f6e7ae59d5fae7170ed10e8380a87ae54 SHA-256: d7b20f8eaefb03d815e6e066337ac8e4189845fbe2569d582f81cda880bca1b8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that redirects to a malicious domain, likely to deliver a phishing lure or malware. The document body, though heavily obfuscated, contains keywords related to puppy sales, suggesting a social engineering pretext. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=pitbull+puppies+for+sale+in+ny+2020
    • https://cdn.sqhk.co/rizijuwet/AhiphZb/wynk_music_app_free_download_for_windows_10.pdf
    • https://cdn.sqhk.co/miviterul/eBAfgjw/freezero_naxeex_mod_apk_android_1.pdf
    • https://cdn.sqhk.co/wobimore/bFjfjhP/misawuk.pdf
    • http://zonafuluza.iblogger.org/coleman_generator_powermate_6250.pdf
    • http://reabook.online/membeli_token_listrik_di_shopeebb6os.pdf
    • https://cdn.sqhk.co/bitowiso/jdhhiiI/flight_boarding_pass_template.pdf
    • http://vkrowl.com/28858286437c373a.pdf
    • http://blu-ital.space/australian_open_2019_draw4k41u.pdf
    • https://cdn.sqhk.co/nuvexajamu/QgdShga/pinata_stick_dollar_tree.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/kaxukok/bpc_enterprises_full_form.pdf
    • http://kokefuvikedile.rf.gd/white_tiger_marvel.pdf
    • https://uploads.strikinglycdn.com/files/869edfb0-3def-4150-aa83-a6ca8a91572a/which_machine_learning_algorithms_use_gradient_descent.pdf
    • https://uploads.strikinglycdn.com/files/3a900a71-3340-41c0-beb6-b4d8e8e7ad11/vizio_m55_c2_release_date.pdf
    • https://s3.amazonaws.com/levovod/muvobipu.pdf
    • https://uploads.strikinglycdn.com/files/7824cbb3-3397-4c08-8581-6f6ee01d9835/ragadorujox.pdf
    • https://s3.amazonaws.com/zoxewudunigus/news_report_sample.pdf
    • http://gisipusizen.rf.gd/9617616784.pdf
    • https://uploads.strikinglycdn.com/files/db2707a7-3892-4f0d-948e-c96581a4537b/how_to_use_mr_clean_magic_eraser_roller_mop.pdf
    • http://tefadipa.epizy.com/life_in_pieces_episode_guide_season_4.pdf
    • https://uploads.strikinglycdn.com/files/140659ce-82f6-4138-815f-e75121f4440a/microsoft_word_software_free_download_for_windows_10.pdf
    • https://uploads.strikinglycdn.com/files/359b95e8-0411-49ee-9e2e-ea04a8153dc5/casio_g_shock_mtg_g1000d.pdf
    • https://s3.amazonaws.com/lanorolowu/serulafuxirobugixupiw.pdf
    • http://jonilobasi.epizy.com/netflix_logo_animation_template.pdf
    • https://s3.amazonaws.com/vofadoloves/dcfs_mandated_reporter_portal.pdf
    • https://uploads.strikinglycdn.com/files/e3e6f176-797d-429b-bd1e-095b6c519225/arcade1up_pac_man_40th_anniversary_review.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec87.bin
492b522524e9f529d14d3b307ed5cf3677ddcfc895c8abcba54331a0e9c3fa9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC87 5412 bytes
font_01_sfnt_off0000ff00.bin
ead949366f60577808719a503a1c57f72991b01ce4a24fad4608d0647cd68e93		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF00 10840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.