Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8bf76ae287d4e75…

MALICIOUS

PDF

77.3 KB Created: 2021-04-26 03:15:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: abb7cd541202f2f0568f9fc5ef2c337f SHA-1: 5ba57050ee197df92dc0c199d0d6bce567ed47df SHA-256: d8bf76ae287d4e750e77dfec9c939a0a94353ff98abc9f17d60582ec219e7610
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a search result for literature authors, likely to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of external URIs and embedded URLs points towards a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=popular+american+literature+authors
    • http://chempion.coffee/bach_brandenburg_concerto_no._2_in_f_major_bwv_1047_freiburger_barockorchesterxm1a8.pdf
    • https://cdn.sqhk.co/dajuzafum/ewI5l0G/how_many_calories_super_bubble_gum.pdf
    • https://cdn.sqhk.co/fewisezux/lhiEp49/81639003498.pdf
    • https://cdn.sqhk.co/kepebeso/4iarPu6/lenovo_thinkpad_x1_carbon_gen_7.pdf
    • https://cdn-cms.f-static.net/uploads/4455681/normal_606b73af15af4.pdf
    • https://static.s123-cdn-static.com/uploads/4414695/normal_5ff0344168f21.pdf
    • http://moitender.org/21196520365fgp8v.pdf
    • https://cdn.sqhk.co/letarezetap/hbibhgc/87528995614.pdf
    • https://cdn-cms.f-static.net/uploads/4495059/normal_601a597b31193.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://da99f664-88c7-4a27-98aa-0bbcec2e8f57.filesusr.com/ugd/66f3f9_bd8a0d303480417c82c3ac1db2ded424.pdf?index=true
    • https://s3.amazonaws.com/zesotat/android_studio_appcompatactivity_fragment.pdf
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_73fc8d09f2004c9296cec40a9f602a1d.pdf?index=true
    • https://s3.amazonaws.com/dosipive/clarence_larkin_revelation.pdf
    • https://7fad2989-91b8-457c-89bc-9a0e7aeef19f.filesusr.com/ugd/b03ff3_3c2c2e3ef82e430c9721c40fba78c873.pdf?index=true
    • https://s3.amazonaws.com/zabevog/guideline_diabetes_2019.pdf
    • https://uploads.strikinglycdn.com/files/df6d1bf6-e65f-4efa-b2b2-ba9b42e57dbf/administering_windows_server_2012_r2.pdf
    • https://s3.amazonaws.com/pozokimepe/gimoxajupuwumujoj.pdf
    • https://d0fd53c2-66a5-49f7-a942-a4bfc50892a3.filesusr.com/ugd/11baf9_947cf3788ec2408f9d4c32c83fb7bc6d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9a7882fd-f5cd-4a00-bc0a-20097e448216/40432723406.pdf
    • https://uploads.strikinglycdn.com/files/69165afb-c15f-4d59-9990-e6fccac2a57f/luvobakodepakifazusat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f092.bin
d66b7eb63e1d45630beb884ced0f8b31561512ef62c078d4f3b0e7418958db68		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF092 5176 bytes
font_01_sfnt_off000101fb.bin
90c987e94dd6892d02f12636a2b35246cf642a17d48f925532c23ad9b248ca65		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101FB 11144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.