Malicious PDF — malware analysis report

Static analysis result for SHA-256 db0bd4208d0c9d55…

MALICIOUS

PDF

83.1 KB Created: 2021-03-27 16:13:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 0081521488d70b9607612103b429c309 SHA-1: 76283beea0aa9dd82029d55a83e74892a39f25f4 SHA-256: db0bd4208d0c9d5516b0713bada8c4d9a4de16fd7e68b18356ad6be1c033abb3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that leads to a suspicious domain, identified as a phishing attempt by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to medical interpretation to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=arterial+line+waveform+interpretation+pdf PDF link annotation
    • https://gakikodokuni.weebly.com/uploads/1/3/1/8/131857060/muxoxojinunigijoxur.pdfIn PDF document text
    • http://nebofimanigi.sportsontheweb.net/vipenevu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410674/normal_60226fa1dc63a.pdfIn PDF document text
    • http://pegijegur.mygamesonline.org/73289444852.pdfIn PDF document text
    • https://pulezigo.weebly.com/uploads/1/3/4/6/134600697/abc7eee8729cd.pdfIn PDF document text
    • https://nibolujadi.weebly.com/uploads/1/3/1/3/131381302/475782.pdfIn PDF document text
    • https://wusafasugulub.weebly.com/uploads/1/3/4/5/134586051/zobejonijolozevari.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4406454/normal_5fdde2c2d35d6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382772/normal_6012384ba7b3b.pdfIn PDF document text
    • http://mizafaroremida.getenjoyment.net/rewekofowubapesux.pdfIn PDF document text
    • http://pemotutafid.mywebcommunity.org/pedagogy_of_biological_science_book.pdfIn PDF document text
    • http://zimezobot.getenjoyment.net/thermador_appliance_repair_san_diego.pdfIn PDF document text
    • https://tifogufa.weebly.com/uploads/1/3/1/6/131637606/4784691.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/darkest_dungeon_steam_guides.pdfIn PDF document text
    • https://s3.amazonaws.com/waxegatulo/cepton_vista_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/sazariwapa/27609571263.pdfIn PDF document text
    • https://7162f0c1-3bb2-4775-9ad2-1e34613fb889.filesusr.com/ugd/595093_314c801e4e0d4518a2fac1b4f9167fe3.pdf?index=trueIn PDF document text
    • http://rogofideb.onlinewebshop.net/6759981138.pdfIn PDF document text
    • https://80820154-e864-4b0c-832b-212b24169927.filesusr.com/ugd/c12414_1e73e0ef9f594989832823ba63e0e486.pdf?index=trueIn PDF document text
    • http://zejibanunepi.myartsonline.com/biocentrism_lanza.pdfIn PDF document text
    • https://d7179dab-c972-4501-9f4a-16044ca71e84.filesusr.com/ugd/434f74_d78d64bae2b54102aa0a91620aca9e70.pdf?index=trueIn PDF document text
    • http://supajiwa.myartsonline.com/1754554988.pdfIn PDF document text
    • https://s3.amazonaws.com/wuniku/ocarina_of_time_n64_rom.pdfIn PDF document text
    • https://s3.amazonaws.com/mixanaz/4liker_instagram_apkpure.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001066e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1066E 5148 bytes
SHA-256: 00bcc03204d939c8eac0c8283d1ce078e6e25bdb3cd71eb64776a7356656b139
font_01_sfnt_off000117fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117FA 10772 bytes
SHA-256: 9186055562814e9f195ea65133f26f509c4f793ddeb6516b5b43383b4b22a602

Open this report in the interactive analyzer, or submit your own file for analysis.