Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7e326ad303fcb5e…

MALICIOUS

PDF

89.6 KB Created: 2021-02-21 01:31:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-03
MD5: 68d2abec8635e322aeb7b55703b212a5 SHA-1: 9aa14cb1c8dde38855fa0d08bae89d14a40e2b8e SHA-256: d7e326ad303fcb5e90483f475949f0966e4554017ef08c51052ead333a56220c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, suggests a lure related to 'foundational curses', likely intended to trick users into visiting the external URL for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+break+foundational+curses PDF link annotation
    • https://cdn.sqhk.co/bumogebiz/hfTNiaS/jodomerikera.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416669/normal_6009262a0134d.pdfIn PDF document text
    • https://cdn.sqhk.co/nonuripot/iALgghj/103516744.pdfIn PDF document text
    • https://cdn.sqhk.co/nejibija/gegchgz/paluviwozefironuratixuter.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452157/normal_5fe3c16082ac0.pdfIn PDF document text
    • https://cdn.sqhk.co/wamiratena/kbjggio/zivutaju.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471095/normal_5fcc71d83153b.pdfIn PDF document text
    • https://cdn.sqhk.co/tipesewete/aYThshj/facebook_stock_price_today_after_hours.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415742/normal_601601cf1b37c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/fowikorejodi/acca_f8_past_papers_free.pdfIn PDF document text
    • https://s3.amazonaws.com/borokegujuzero/84852397140.pdfIn PDF document text
    • https://s3.amazonaws.com/zuniverijesud/87069680102.pdfIn PDF document text
    • https://s3.amazonaws.com/kefodek/free_printable_boundary_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/bokofapig/statoil_asa_annual_report.pdfIn PDF document text
    • https://s3.amazonaws.com/jefobexapulow/daguzatanuvironez.pdfIn PDF document text
    • https://s3.amazonaws.com/lonozote/13689280944.pdfIn PDF document text
    • https://s3.amazonaws.com/norozovijalu/70462123747.pdfIn PDF document text
    • https://s3.amazonaws.com/baxadelefofibuz/headed_paper_word_template.pdfIn PDF document text
    • https://s3.amazonaws.com/tirimofufemukat/misizesosexe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000112b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112B3 5272 bytes
SHA-256: 823a5d16c76218d4a8cb3331849113b158df2c792871bf02a9093704b50bc3cb
font_01_sfnt_off000124b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124B7 6148 bytes
SHA-256: be38186c9256ba0e64b07d34cca2e63b176d3ffd182ae4667a642b503e748fe0
font_02_sfnt_off00013497.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13497 10548 bytes
SHA-256: 253a74c86c8b65cd04a6e405ae5c6baea7cace80b649671cc851e2dc197b2fce

Open this report in the interactive analyzer, or submit your own file for analysis.