Malicious PDF — malware analysis report

Static analysis result for SHA-256 dab8e20fb5f8fda8…

MALICIOUS

PDF

80.6 KB Created: 2021-04-05 07:16:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 19bf0ece0ad57e31b7bacd014ee47a9f SHA-1: 9d2fead67894aa1d3751a90e50d8a22b82d70934 SHA-256: dab8e20fb5f8fda88ed8f20f7f327ccb314af4b7f079933906b4acb90e8b6374
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, which is also present in the document body as a fake error message. This suggests a phishing attempt to trick the user into clicking the malicious link. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=quicken+printer+not+activated+error+code+30 PDF link annotation
    • http://vobafoselalulor.mypressonline.com/jejopixolitalibo.pdfIn PDF document text
    • http://potenciy.xyz/metodologia_de_la_investigacion_libro_hernandez_sampieri9rmr3.pdfIn PDF document text
    • http://dmdmassage.com/vefavinagisemewazekuzia6a.pdfIn PDF document text
    • http://granitmetrospecstroy.ru/arkham_horror_rules_reference5vcsi.pdfIn PDF document text
    • http://jedilinosur.mywebcommunity.org/hebrew_greek_keyword_study_bible_kjv.pdfIn PDF document text
    • http://strita.space/taylormade_golf_m2_manuala0ivm.pdfIn PDF document text
    • http://pivolirarorip.mypressonline.com/beef_cattle_production_system_in_ethiopia.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/9fdccc5d-bd26-4acd-9e50-f61a972c80e2/hp_photosmart_7525_ink_refill.pdfIn PDF document text
    • https://s3.amazonaws.com/pavujiniz/16099603037.pdfIn PDF document text
    • https://s3.amazonaws.com/lijulijowivaze/counterfeit_currency_full_form.pdfIn PDF document text
    • https://s3.amazonaws.com/zizene/zajigimekamopupujidozitu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0edb8702-721a-4754-9074-4dd6875de27d/japji_sahib_in_english.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6391009-3927-4ef1-a4f5-58cd3e3756d2/lorudubavefiwesoretoseve.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30cd761a-64a0-4348-8363-3cfa04f940e3/fepuxerubibunekujedire.pdfIn PDF document text
    • https://s3.amazonaws.com/rizoli/vavomirow.pdfIn PDF document text
    • https://s3.amazonaws.com/pegozegi/alone_movie_hd_2015.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d664539e-d325-4466-95d1-f3316b659658/bejobemilanawuzego.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97312998-2b4d-40b3-9224-6134dfaa448e/what_the_best_scripting_language_to_learn.pdfIn PDF document text
    • https://s3.amazonaws.com/muvojugejoxip/gekiligezigabame.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30376df6-f5db-4578-bc1e-df977f84c4d7/xbox_one_controller_lb_button_stuck.pdfIn PDF document text
    • https://s3.amazonaws.com/fojaxexino/v_shred_clean_bulk_program_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26195d0a-1268-49f4-9e17-5e5465e62a67/what_did_maya_angelou_accomplish.pdfIn PDF document text
    • https://s3.amazonaws.com/lolaritemukole/mafasokuzow.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1A5 5232 bytes
SHA-256: c38712ace59bdc4bfd874b1006c4055077164e850734e892011a15ce536eb17e
font_01_sfnt_off0001037f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1037F 10236 bytes
SHA-256: 386d2f2b86a4666eb88eef800a825f8df0cc2d2c80a921e82977a58ffa5bfabf
font_02_sfnt_off00012691.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12691 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.