Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9e1323e0eef49b5…

MALICIOUS

PDF

83.4 KB Created: 2021-03-25 06:17:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a04f91def0801d158c3da00f2f5d8888 SHA-1: efcff7ae2002636afbb83979b1741803a7a7d59e SHA-256: d9e1323e0eef49b535b302dabae3f7abc5b916ac52850d5378d8b77e9bd51a94
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a search result for "fantasia 2020 pictures", likely intended to trick the user into visiting a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a phishing or trojan distribution attempt. No scripts were extracted, but the presence of an external URI and the ML detection strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=fantasia+2020+pictures
    • https://static.s123-cdn-static.com/uploads/4497078/normal_5ffeb20247a6d.pdf
    • https://static.s123-cdn-static.com/uploads/4376105/normal_5fdec4ad68c6c.pdf
    • http://koponegigat.medianewsonline.com/68457296637.pdf
    • https://cdn-cms.f-static.net/uploads/4458622/normal_6023cdaab9b09.pdf
    • http://bometaximom.scienceontheweb.net/keith_urban-youll_think_of_me_lyrics_karaoke.pdf
    • https://cdn-cms.f-static.net/uploads/4458635/normal_60570b55a0205.pdf
    • https://cdn-cms.f-static.net/uploads/4530937/normal_603b9db8c2330.pdf
    • https://static.s123-cdn-static.com/uploads/4448547/normal_5ff3423fedda0.pdf
    • https://cdn-cms.f-static.net/uploads/4480758/normal_6026f6c749fd7.pdf
    • https://static.s123-cdn-static.com/uploads/4366973/normal_5ffb9121427f2.pdf
    • https://static.s123-cdn-static.com/uploads/4373755/normal_5fcdafc248e42.pdf
    • https://cdn-cms.f-static.net/uploads/4367903/normal_601e95b6b970f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://a0f88182-e1f9-4a9c-ba22-d5ce004c6985.filesusr.com/ugd/2f3216_4a2ae5c4554d433cb33b4d8199fadc1d.pdf?index=true
    • https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_cbee1bb44bc3481997aab5ae133a1d33.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b94ce5df-999b-47fb-8a93-7a63b0fca559/what_is_the_mail_recovery_center.pdf
    • https://7afcd0b8-98df-42a4-afe0-9544d44c9539.filesusr.com/ugd/74e9cf_26f5a706583d470eacd589585fb09cd1.pdf?index=true
    • https://b03e51a8-7171-48c0-94d6-e4c032e6f37f.filesusr.com/ugd/9421c8_ec3d3c90e3db4b7b9c28d7d21a6a1f0d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0c3acb7c-7c18-4a77-bcfb-aebe3e8de1d5/mr_coffee_iced_coffee_maker_how_it_works.pdf
    • https://uploads.strikinglycdn.com/files/0dcb2e3d-9039-4e28-903c-516285d478e8/bosch_super_silence_plus_42_dba_reset.pdf
    • http://taguloxutenafol.myartsonline.com/imperative_affirmative_and_negative_exercises.pdf
    • https://700ceb37-22d2-47c5-9888-d858af679aee.filesusr.com/ugd/c345b0_471738d270834ad591b68764b370d9f3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/22d31ae1-187b-4478-8481-b420d6a7d2fa/kutomomedugorov.pdf
    • https://uploads.strikinglycdn.com/files/47105854-fd1b-43e9-bb9b-21316f33ff3b/what_is_a_synonym_for_subjective_well_being.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eecc.bin
93e1da4877c7673ced3a440955b1747bf11a35a6cbd372c16bdfaf1abd1697c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEECC 3044 bytes
font_01_sfnt_off0000f9a1.bin
3651cc74d69f3c7663de7eb07ebe2a6e3d42b240e36ac31d58ab7c0a4ea2d2a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9A1 4896 bytes
font_02_sfnt_off00010a49.bin
365ba288c29e1b5673d29bc4bd9f4ce51910f154ca5de3556eb17910877c18ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A49 11616 bytes
font_03_sfnt_off00013148.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13148 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.