Malicious PDF — malware analysis report

Static analysis result for SHA-256 d805ca128abcbae7…

MALICIOUS

PDF

76.8 KB Created: 2021-03-22 13:50:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e938d1a7c833fec0a523737ef135e91e SHA-1: 96a14c5cdea3f10c9ece679d04507dc4f8dad3a7 SHA-256: d805ca128abcbae74b1a3d736fdb120b0ad29cad10ef674ec47c496e79e39f62
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that points to a suspicious domain. ClamAV and ML classifiers flagged this PDF as malicious, specifically as a phishing trojan. The presence of the external URI and the overall classification strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=sf+dharma+collective+calendar
    • https://cdn-cms.f-static.net/uploads/4501204/normal_6025b33e4a9ff.pdf
    • http://wamipivifubape.sportsontheweb.net/jukumaz.pdf
    • http://jekeluxuto.mywebcommunity.org/65160822517.pdf
    • http://natezaka.iblogger.org/what_is_the_best_bookkeeping_course_to_do.pdf
    • https://cdn-cms.f-static.net/uploads/4379487/normal_5fe6d30ba68bf.pdf
    • http://siondez.ru/why_use_tables_to_present_data9jrxu.pdf
    • http://ag-management.space/font_awesome_cheat_sheet_4._7._0fgs7e.pdf
    • https://static.s123-cdn-static.com/uploads/4374835/normal_600419a102007.pdf
    • http://veselutut.mywebcommunity.org/zalono.pdf
    • http://kimisorunutom.medianewsonline.com/lajagopozozimazadalusaxu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wujodibu/55927355404.pdf
    • https://uploads.strikinglycdn.com/files/663a6df6-3c48-4ea7-93be-76b71e997f3a/32126813316.pdf
    • https://uploads.strikinglycdn.com/files/0f7a05ec-b0af-4094-b7df-207b4147aa36/states_of_matter_practice_worksheet_3rd_grade.pdf
    • http://modurogodolu.epizy.com/brenton_tarrant_manifesto.pdf
    • https://s3.amazonaws.com/dinilederu/duwobejixopag.pdf
    • https://uploads.strikinglycdn.com/files/ecb11634-093e-4899-8123-5c8143a64bce/wewugugexeziturizosovezi.pdf
    • https://s3.amazonaws.com/zafirawit/free_editable_business_letterhead_templates.pdf
    • https://uploads.strikinglycdn.com/files/a5f849c7-5459-4eab-af39-802fde4ff23e/maths_book_for_class_7_maharashtra_board.pdf
    • https://uploads.strikinglycdn.com/files/6bdf730b-c1e4-4193-99bf-10bf3c0b1ed7/56225982184.pdf
    • https://s3.amazonaws.com/mamukawaxatali/42947744920.pdf
    • http://nivuzujanux.myartsonline.com/raxoxoboxeruxe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de6e.bin
49a6eaaa04c62e01429c5559dfb86b47dda8463d9a8c0d773c1c1708c7eeda14		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE6E 5244 bytes
font_01_sfnt_off0000f01e.bin
7d42751ef427fcfece79a72a3b7e8f89729711c3605617fadbbb8be9f2fcab58		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF01E 3020 bytes
font_02_sfnt_off0000fca9.bin
53d3916a1d2d353ffb3d3a4e743f353dac257fde7fb46940cbfd3697a405ef92		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA9 11700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.