Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd883ff24239be09…

MALICIOUS

PDF

82.5 KB Created: 2021-03-08 17:42:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 908efeb710bd2ca9c6690f989ec4ebfd SHA-1: d7f0903dc3b1b474ee4988ed871a1caaa5d4c36b SHA-256: dd883ff24239be09e6148ae66394a7653d031171ecf3a7b6c762c623f99761ea
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URI points to a suspicious domain, likely intended to host phishing content or a further payload. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, consistent with a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=rock+band+4+compatibility+list
    • https://cdn-cms.f-static.net/uploads/4467003/normal_6032c66e26efc.pdf
    • https://cdn-cms.f-static.net/uploads/4384639/normal_5fe902d9b3d1e.pdf
    • https://cdn.sqhk.co/dofubetu/gh9hcjg/tornado_alley_states.pdf
    • https://cdn-cms.f-static.net/uploads/4454811/normal_603844387c1d0.pdf
    • https://cdn-cms.f-static.net/uploads/4488558/normal_6029977e52b7b.pdf
    • https://cdn.sqhk.co/jexozumumanu/1idRKia/49856286479.pdf
    • https://cdn-cms.f-static.net/uploads/4450517/normal_6041aacebf2a5.pdf
    • https://static.s123-cdn-static.com/uploads/4445338/normal_5fe2afbc10f67.pdf
    • https://cdn-cms.f-static.net/uploads/4393638/normal_5fd130602d559.pdf
    • https://cdn.sqhk.co/xujurovemu/dViihfz/ligub.pdf
    • https://cdn-cms.f-static.net/uploads/4463792/normal_601aff23cafe7.pdf
    • https://cdn.sqhk.co/sebutarukaw/cp2Lqev/great_clips_near_me_open_now.pdf
    • https://cdn.sqhk.co/jedelamodafa/gJtgfZm/lovonaju.pdf
    • https://static.s123-cdn-static.com/uploads/4387716/normal_5ff16d79b3aa4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tabewozuzigenog.epizy.com/immanuel_kant_books_free_download.pdf
    • https://uploads.strikinglycdn.com/files/ebb0d3d4-9d74-4e1a-8268-92821d30daec/adobe_audition_midi_keyboard.pdf
    • https://uploads.strikinglycdn.com/files/e753a21c-771a-4e0c-ac7a-ae6d2e24bb76/second_order_derivative_exponential_function.pdf
    • http://katewamopexo.rf.gd/tivumubiwevepafavatapax.pdf
    • http://sikejafomanama.epizy.com/78260036689.pdf
    • http://ziwufuv.rf.gd/97710239082.pdf
    • http://vubolax.epizy.com/gexur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010471.bin
cabba6f6fb6b77cc7b65348da0cd3ec48bdb53d58318eba00e9fc27ada4a45f6
pdf-font-stream PDF embedded font (sfnt) at offset 0x10471 5524 bytes
font_01_sfnt_off0001173f.bin
85ef8ea2b4a5ff82e6013e2e8433c6f1fac875b88778a4ff4e8df0a4b673c7ae
pdf-font-stream PDF embedded font (sfnt) at offset 0x1173F 10928 bytes