Malicious PDF — malware analysis report

Static analysis result for SHA-256 dabf1774a3cedc3b…

MALICIOUS

PDF

74.7 KB Created: 2021-03-17 00:58:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 91648fffb90fc68a586b1b006063b434 SHA-1: dc9a6437ee8b2da76a13a6414320d7c487957548 SHA-256: dabf1774a3cedc3b1a282c0cfbf1a49e4ffbd4356082142d5a111be8da90383c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an external URI pointing to a suspicious domain, likely a phishing lure. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it is designed to redirect users to malicious websites, potentially for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=the+intention+experiment+book+review
    • http://rorujav.22web.org/soxipetorunavab.pdf
    • https://cdn.sqhk.co/mudogaxi/QlAjhNt/lonijaxutadumumo.pdf
    • http://creditscorehelp.info/new_bodo_video_2017_hd8o6v2.pdf
    • https://cdn.sqhk.co/vuzujugasije/ieic7Uo/aliexpress_usa_shipping.pdf
    • https://gojufepegaxop.weebly.com/uploads/1/3/4/3/134339744/nelep-zojafulokigipa.pdf
    • http://lavka-karamel.ru/how_to_mount_a_gopro_on_a_selfie_stick9qazk.pdf
    • https://bosewumakujo.weebly.com/uploads/1/3/6/0/136036310/sowolulevibo.pdf
    • http://faceit.su/evaluating_limits_graphically_1_worksheet_answersyk8nt.pdf
    • https://cdn.sqhk.co/kiraxozi/4Vhfgdm/meban.pdf
    • https://cdn.sqhk.co/vamosopon/ahgwjzx/43621750370.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/woxewiwupir/20685094685.pdf
    • https://fdb0147f-387d-4908-9c93-1ccdb5bf775f.filesusr.com/ugd/aea2e0_b5affa433c8a433fa3329d88d4e3bd11.pdf?index=true
    • https://2ac56fc1-f7ee-4366-9cb2-1681469c68ee.filesusr.com/ugd/b914b5_d27a7b25c9a84669b57a9750b13e4442.pdf?index=true
    • https://s3.amazonaws.com/kotodur/tutenosipaxizus.pdf
    • http://mulizin.epizy.com/wabub.pdf
    • https://s3.amazonaws.com/vuforewebub/how_much_oil_does_a_2015_ford_fiesta_take.pdf
    • http://nifekubipaxo.epizy.com/soxufujizutubujix.pdf
    • http://rorufefujolag.rf.gd/wifixulinepoxakidur.pdf
    • https://83d12552-0bc1-4415-b221-1da25caacb9b.filesusr.com/ugd/1e11d0_cce30e647c1042b08cfbc24c2e208727.pdf?index=true
    • https://s3.amazonaws.com/nupotukig/50122915650.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e588.bin
3527980a264019f0fef30f2642230945cbe549ec8e38a3c3b49065167c12cc7e
pdf-font-stream PDF embedded font (sfnt) at offset 0xE588 5012 bytes
font_01_sfnt_off0000f67b.bin
eb8325a64661c4dfa213afc9ef88c7a4f145d7951e1480a6d4f944172d26fbb4
pdf-font-stream PDF embedded font (sfnt) at offset 0xF67B 10992 bytes