Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbb9a0310c83fbe1…

MALICIOUS

PDF

75.2 KB Created: 2021-03-09 06:59:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 727100ee9e82669c8a3afe610221a9a3 SHA-1: 2475060cc63dd18c97d59e50ac4b1e1662b85ab2 SHA-256: dbb9a0310c83fbe1154d3a5f73f2c1ece392534a708510af74a5008dd80d7dba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ML and ClamAV, indicating malicious intent. The presence of an external URI pointing to 'pelibifir.ru' suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a lure to a malicious site, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=smarty+pins+google+jugar
    • https://static.s123-cdn-static.com/uploads/4413112/normal_5ffa6b462f3af.pdf
    • https://cdn-cms.f-static.net/uploads/4450350/normal_602aaa166e3b6.pdf
    • http://electorat.org/music_video_creator_freeq8w4t.pdf
    • http://feedbacrnz.space/52263002270smnnb.pdf
    • http://afterdealer.pro/nififudenutagolitasusowijf1ed.pdf
    • http://gouliwer.online/shalom_aleichem_sheet_music_download2dotg.pdf
    • http://kolomata.ru/mercury_sc1000_smartcraft_speedometer_tachometeri252m.pdf
    • https://cdn-cms.f-static.net/uploads/4475565/normal_600e955e41367.pdf
    • http://firstdoctor.xyz/remington_rebel_16_42cc_gas_chainsaw_reviewsvemif.pdf
    • http://helpcenter.business/90473022323ft20o.pdf
    • http://zalavsky.ru/65505478440n32z1.pdf
    • http://creditinquiry.info/gulugutogatux1kh1w.pdf
    • https://cdn-cms.f-static.net/uploads/4366324/normal_600eca52f0000.pdf
    • https://static.s123-cdn-static.com/uploads/4493597/normal_5ff860c17aeb8.pdf
    • http://ouily.xyz/is_guidepoint_global_advisors_legithiqel.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://37628037-8ed2-4234-80bf-d3204aa213b5.filesusr.com/ugd/c4dbd3_712473fc71444d9bb82bfbecaaae9fff.pdf?index=true
    • https://6632aaff-1fe9-4f1d-acb3-7d444e457837.filesusr.com/ugd/ce4b7c_8560d5f0cdac4d12aef493e4dc3ad598.pdf?index=true
    • https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_e51f170975f344959121a9712329731b.pdf?index=true
    • https://s3.amazonaws.com/wutezigojuxi/26676046100.pdf
    • https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_f5df69197ad4466eb6331e7d40fcf418.pdf?index=true
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_2731cf76241c423382c5216e270625dc.pdf?index=true
    • https://s3.amazonaws.com/jaxesabi/jutezisofi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9df.bin
0fd87d5ed12f12c5d00b78facf8ffb0327dff1cc18832b678c8132f12ed2d84f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9DF 5420 bytes
font_01_sfnt_off0000fc41.bin
cfb50534af0fa95fe7d9ebd9b34ff9a0d4a7c7bbe0f9831ca244228dc35ba132		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC41 10320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.