Malicious PDF — malware analysis report

Static analysis result for SHA-256 d88d11c4bd97324e…

MALICIOUS

PDF

83.0 KB Created: 2021-04-05 04:33:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd0dedaa5fc794f648e984a51647e1e4 SHA-1: 74e25b8256ccb3793280f1ebd68b7fca06978211 SHA-256: d88d11c4bd97324e8d5b7930120b0d9d80f7fafd4237dd928c9ad1a82e3ce108
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains multiple embedded URLs, one of which, 'https://zajinet.ru/award?keyword=diccionario+biblico+catolico+leon+de+four+pdf', is directly flagged. The document body, though heavily corrupted, suggests a lure related to a 'Diccionario biblico catolico' and mentions wkhtmltopdf, indicating it was likely generated by a tool rather than being a legitimate document. The presence of embedded URLs strongly suggests an attempt to redirect the user to malicious sites for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=diccionario+biblico+catolico+leon+de+four+pdf
    • http://mitatizizuje.mypressonline.com/jowowolulumodux.pdf
    • https://cdn.sqhk.co/zanotunuzi/gg1jdmD/chain_reaction_movie_motorcycle.pdf
    • https://cdn.sqhk.co/safajoju/yhfo9ie/26928115863.pdf
    • http://bogplaktnc.fun/is_randomness_really_randomxow3p.pdf
    • http://gbo.guru/61393391044wn7ra.pdf
    • http://rumepado.mypressonline.com/lenovo_yoga_500_laptop_charger.pdf
    • http://momentikshop.space/72771853657wu5ww.pdf
    • http://complect-tech.ru/16161955633qyjxx.pdf
    • https://cdn.sqhk.co/sixepatexup/jcia9ge/88507794663.pdf
    • https://cdn.sqhk.co/laloropaki/dtKyola/90901116863.pdf
    • https://cdn.sqhk.co/nulusezitelo/gPibhie/learn_flags_of_the_world_quiz.pdf
    • http://picsonair.com/lol_na_windowsg2bm5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9597a069-a6c5-4d11-bd75-549e6acf1312/12741010206.pdf
    • https://uploads.strikinglycdn.com/files/eae1209f-93f4-4c02-9afe-4174b94c6f99/jusuzerob.pdf
    • https://uploads.strikinglycdn.com/files/9bb30dc1-43c4-44df-8888-6c962e48b4bc/personajes_mas_importantes_de_la_independencia_de_mexico_y_lo_que_hicieron.pdf
    • https://uploads.strikinglycdn.com/files/616c5acc-0256-48d6-bd57-5c7f49ea77d0/what_is_the_general_lifetime_of_an_atom_in_an_excited_state.pdf
    • https://uploads.strikinglycdn.com/files/525999bc-5ef9-4bf1-91d8-395e84afa34a/61682129272.pdf
    • https://uploads.strikinglycdn.com/files/995d3c6c-f891-49a6-92e1-1d40e75a4e7c/53982995816.pdf
    • https://s3.amazonaws.com/vabemavuputenif/what_are_some_muscular_endurance_exercises.pdf
    • https://s3.amazonaws.com/xazarujokemus/babefak.pdf
    • https://s3.amazonaws.com/lovetijif/46027425185.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eedb.bin
c3b5d968d3c4698bf8a167e81874dcbc71b9114b2eebd5bdc2e47e3a7225a00e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEDB 5112 bytes
font_01_sfnt_off00010050.bin
cad3a68ad8f6be451b759d0b73102ab70f7427b4a430cb10f4f1199864a8221e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10050 11980 bytes
font_02_sfnt_off00012705.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12705 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.