Malicious PDF — malware analysis report

Static analysis result for SHA-256 d97bb3737198a36f…

MALICIOUS

PDF

82.0 KB Created: 2021-04-02 09:58:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 233e474677a07b97d5b494ca492b387e SHA-1: 461039992a0c7b74310629e57e480983ff6bbf50 SHA-256: d97bb3737198a36f92e107290340cfe00153aab7a1893a30ae386141c7b1711e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains an embedded URL that likely leads to a malicious payload. The document body, though heavily obfuscated, suggests a lure to download further content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=download+i+am+gonna+stand+by+you
    • http://rodsfish.club/soluxogotosasaxezipovds4v.pdf
    • https://cdn.sqhk.co/kizusuvut/NLvvggf/55697371811.pdf
    • http://zonizubiro.getenjoyment.net/pawimis.pdf
    • http://taxevidel.medianewsonline.com/kenneth_cole_reaction_watch_turn_off_alarm.pdf
    • https://cdn.sqhk.co/sunawopi/gggcXhh/tagomogemona.pdf
    • http://dream-stat.ru/953453044589w2pk.pdf
    • https://cdn.sqhk.co/zopimoforaja/dc4zkDh/mame4droid_0._139_u1_bios_pack.pdf
    • http://dusamoka.mywebcommunity.org/93005762049.pdf
    • https://cdn.sqhk.co/fufowomusixi/jKo4igm/25976150621.pdf
    • http://jisetatiloro.scienceontheweb.net/96130633602.pdf
    • http://dudoxanudito.scienceontheweb.net/modal_verbs_exercises_upper_intermediate.pdf
    • http://jijuduli.mywebcommunity.org/computer_backpack_with_wheels.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://uploads.strikinglycdn.com/files/3ba79d2c-b466-4621-afa5-a4cbdfd130ea/jekafujadadu.pdf
    • https://uploads.strikinglycdn.com/files/450d7025-8474-44fe-8f33-5a74ebc0924f/xonelijuzulupaxugu.pdf
    • https://uploads.strikinglycdn.com/files/d019cd1a-6df4-4156-9c4a-09a547b8b9f5/39280869238.pdf
    • http://popofisofol.myartsonline.com/catholic_bible_quiz_questions_and_answers.pdf
    • http://goxafebo.myartsonline.com/estrategias_para_el_aprendizaje_cooperativo.pdf
    • http://tososite.onlinewebshop.net/68150419770.pdf
    • http://jumawivowibeb.onlinewebshop.net/borujojatesonumenigikov.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d356.bin
37cee4e33f1dc522a54f1858c0ebf124408ef82e62b1124dbfa31037e7e8664a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD356 5380 bytes
font_01_sfnt_off0000e5a6.bin
d2d10b6b0c668cf26faa9347c7054f8580c7eefa5cb7aecda2a4fba74bd025f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5A6 6068 bytes
font_02_sfnt_off0000f557.bin
85f4b5d5cf0dee31428bd52f4b8727286ec47f64c704ac511a1c5d9dc5587c4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF557 11252 bytes
font_03_sfnt_off00011a84.bin
9e8409b995ac2b0bb76eb3eb8dd1c90fa55d1c1c8a40bb5daa08ca4080948d13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A84 18776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.