Malicious PDF — malware analysis report

Static analysis result for SHA-256 d821e4a5a365f9ff…

MALICIOUS

PDF

90.3 KB Created: 2021-03-14 13:17:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b52942dcafdd4b9bac7267aa1c72b2fa SHA-1: 2f3555f9652d4d7e9f735e6316315f595825f93b SHA-256: d821e4a5a365f9ffb1dc3f470572c00ecaaa7e6be11568a35045c36deb9cd24c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, contains references to 'Camera 360 iphone' and 'wkhtmltopdf', suggesting a lure for software or information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=camera+360++iphone
    • https://cdn-cms.f-static.net/uploads/4446275/normal_6047b0954e204.pdf
    • https://cdn-cms.f-static.net/uploads/4460723/normal_603d0ffa28d1f.pdf
    • http://tejidirexe.mywebcommunity.org/how_to_empty_brother_waste_toner_box.pdf
    • https://cdn-cms.f-static.net/uploads/4471095/normal_602907f90c56b.pdf
    • https://cdn.sqhk.co/lewikokezina/jFhji14/adenine_complementary_binds_with_thymine_and_forms.pdf
    • https://cdn.sqhk.co/gebunemif/hfgdC46/23163323751.pdf
    • https://cdn.sqhk.co/kezixowog/iahejgh/hop_step_jump_anime.pdf
    • http://fisujerekuvij.getenjoyment.net/38010773945.pdf
    • https://cdn.sqhk.co/kujaruwajovi/dYL3zid/lalanap.pdf
    • http://xorimomupajo.scienceontheweb.net/do_kenmore_washers_have_lint_traps.pdf
    • https://cdn.sqhk.co/vusabutam/pjakih1/44421664162.pdf
    • http://rowaxamapitowej.getenjoyment.net/what_are_the_safe_areas_of_new_york_city.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wixanarer/80949839103.pdf
    • https://s3.amazonaws.com/mejigavukolu/pufib.pdf
    • https://uploads.strikinglycdn.com/files/4ba0397e-14a0-4540-8fe6-cdbd7df9aee3/11097203047.pdf
    • https://s3.amazonaws.com/jinabisura/cakephp_complete_tutorial.pdf
    • https://s3.amazonaws.com/bajuse/animated_shiva_wallpaper.pdf
    • https://uploads.strikinglycdn.com/files/2b3239f8-f3ef-4753-ae33-8e751bf98ab2/1725498937.pdf
    • http://rixuroruwe.myartsonline.com/big_green_egg_large_size.pdf
    • https://s3.amazonaws.com/pusixa/81737055468.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2a7.bin
f77bc989ad6e065eed35ba9edcee80420cf7f7456f9239bcf5b317a80c39bd30		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2A7 3232 bytes
font_01_sfnt_off0000fdf3.bin
a1ac057a654640d4c7b242bbe37a492009f633d6eb018855588eed7809854c1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDF3 5212 bytes
font_02_sfnt_off00010f6a.bin
15b9128b016d21f2c8b9d0520eb8b91f1393727a403a8af83117b1998297a733		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F6A 4452 bytes
font_03_sfnt_off00011b7b.bin
348c4869ef0b6bbb07193b39957ca74a47f37ff0112a5d60c4d5d4c2630e41bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B7B 11640 bytes
font_04_sfnt_off0001434d.bin
1f7e257e5174569cdb3c0abd28e2576d093cf6edcf771fbdc926de7a8b314256		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1434D 16864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.