Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddbb534baeb4b1de…

MALICIOUS

PDF

78.1 KB Created: 2021-05-05 00:12:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d3410d95e433d25721cb909e2b812cbc SHA-1: d6d9ebf302735b3d545ce79e869b78515032b439 SHA-256: ddbb534baeb4b1de15bf7b6d2551775166c82d07bfa81f5b6621e19b0a32fad3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text related to unit conversion ('Cuanto equivale un pie lineal en metros') which serves as a lure. An external URI pointing to 'https://vilenefex.ru/strik' was extracted, suggesting the document's purpose is to redirect the user to a malicious site, likely for payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=cuanto+equivale+un+pie+lineal+en+metros
    • https://cdn-cms.f-static.net/uploads/4387573/normal_601c87b40ec02.pdf
    • https://cdn-cms.f-static.net/uploads/4425214/normal_6014a4d8d9890.pdf
    • http://creamwalls.online/96109068061xrmtd.pdf
    • http://usesoda.pro/bijivimikabit5vq.pdf
    • https://cdn-cms.f-static.net/uploads/4460981/normal_60564e141b1ca.pdf
    • http://xizerunax.scienceontheweb.net/77049944009.pdf
    • https://static.s123-cdn-static.com/uploads/4464877/normal_5fc8c6546913b.pdf
    • http://grigolia-studio.ru/kevomeganegivijadxim3m.pdf
    • https://static.s123-cdn-static.com/uploads/4489237/normal_5ff42483bb06b.pdf
    • https://static.s123-cdn-static.com/uploads/4480393/normal_5fc8ee0b19b46.pdf
    • http://fikowadem.22web.org/historia_de_las_bacterias.pdf
    • http://bamimutekinawaz.22web.org/postgresql_analyze_function_performance.pdf
    • https://static.s123-cdn-static.com/uploads/4374835/normal_5fcd64fa82a45.pdf
    • http://insuranceautousa.com/38168548726g82nd.pdf
    • http://zovolexune.sportsontheweb.net/caderno_de_encargos_sudecap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fufifaramulemi.rf.gd/cien_aos_de_soledad_personajes_y_caracteristicas.pdf
    • https://uploads.strikinglycdn.com/files/79b1d634-3f96-48ec-afe0-786e19ac35e0/the_ugly_american_sparknotes.pdf
    • http://zesafemumibow.myartsonline.com/calculus_early_transcendentals_7th_edition_solutions_manual.pdf
    • https://uploads.strikinglycdn.com/files/5deed69f-385e-498e-9e05-23843c42648e/jiguluwuwekomexefofojaxe.pdf
    • https://uploads.strikinglycdn.com/files/81e8c75f-e004-419d-9455-5f08e772cbde/41333216696.pdf
    • https://uploads.strikinglycdn.com/files/2322681d-9935-4a8f-80ce-e9f3f8d8d7cd/troy_bilt_pony_riding_lawn_mower_belt_diagram.pdf
    • http://mozilerinalut.epizy.com/45089270811.pdf
    • http://sudajakabeba.epizy.com/epo_guidelines_problem_solution_approach.pdf
    • http://gejizejaniwijef.atwebpages.com/47645261621.pdf
    • https://uploads.strikinglycdn.com/files/976ce54e-21d1-4a5b-b73d-f82bb05aec35/47116396579.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecdb.bin
5288dfec88c6bfd8338e786f3e7c3c78108e97d48fa91076e421ae28c9002955		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECDB 5056 bytes
font_01_sfnt_off0000fdf9.bin
ae1a11b998e0cdf6a9e509dbfc15fd8ff127c30894366f108980486a1332de30		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDF9 13220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.