Malicious PDF — malware analysis report

Static analysis result for SHA-256 daaa103e16dd8848…

MALICIOUS

PDF

80.1 KB Created: 2021-04-27 06:51:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: df1dc742ded73b8be69d7b691aa8dbbe SHA-1: 6d1590d0df0eadd5452e951d16f1217e2dcb0f9a SHA-256: daaa103e16dd88488d92b58b28e1f577e49ef3507cc67fc4cd92973e9493ee9a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to driving theory tests.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=uk+driving+theory+test+2019+practice
    • http://lumacy.site/84130683739reo7g.pdf
    • http://form-lnstagramverificationbadge.com/bogal87tyw.pdf
    • http://smartcreditus.info/mugenewosopuxav4ndr1.pdf
    • https://kekageguva.weebly.com/uploads/1/3/0/7/130776826/8462449.pdf
    • https://cdn.sqhk.co/vonixilavot/ptYih2O/japamedev.pdf
    • http://sreda.city/libro_azul_marzo_2020zq4g1.pdf
    • http://bigtittybella.com/why_my_dryer_not_hotmrnpm.pdf
    • http://ueuniti.website/enigma2_para_sempre_carteirascm50n.pdf
    • https://cdn.sqhk.co/nipumusawobo/cI36ifQ/brick_breaker_java_240x320.pdf
    • https://cdn.sqhk.co/xunalafugapa/ihpNHig/angel_has_fallen_movie_free_mp4.pdf
    • https://tibuvaji.weebly.com/uploads/1/3/4/7/134720571/xitigiwupuw.pdf
    • http://bezprovodov.guru/zigijigifel2ciw.pdf
    • http://my-favshopc.online/vazejezojoxakefutezab05p6m.pdf
    • http://uptodate.site/303439586964jsoz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://xowuxojugo.rf.gd/baptist_faith_and_message_1925.pdf
    • https://uploads.strikinglycdn.com/files/cf5473f6-57f2-4e83-ae30-8d04c7573a20/47087039267.pdf
    • http://jusowegakero.epizy.com/ssc_je_admit_card_2018-_19.pdf
    • http://jirovod.rf.gd/how_to_clean_tiger_rice_cooker.pdf
    • https://uploads.strikinglycdn.com/files/57a0eb1e-1bad-4617-b8fd-e7e361131f95/samsung_dishwasher_auto_and_heavy_light_blinking.pdf
    • https://uploads.strikinglycdn.com/files/89659f0a-9595-47f7-9345-bed6dc844e6c/dudoxoxetij.pdf
    • https://uploads.strikinglycdn.com/files/1676de0f-cbe9-4ded-9d1d-0b069e8f2377/eureka_whirlwind_bagless_canister_cleaner_nen110a_lightweight_corded_vacuum.pdf
    • https://uploads.strikinglycdn.com/files/bf116ed5-2d44-4448-b511-e73cc102eff8/selekirovivega.pdf
    • http://foduwisidowej.rf.gd/62168351435.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb1c.bin
8e08d23ef7c101ed42fa755625552d27a264f86b693d63e4d7fa860a9d664615		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB1C 5788 bytes
font_01_sfnt_off0000fed9.bin
d29c520ad6577e89f323eecc8e69073221deb8f72ffb22244c1856df4094d694		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFED9 11000 bytes
font_02_sfnt_off00012443.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12443 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.