Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddd19e3913babe95…

MALICIOUS

PDF

87.4 KB Created: 2021-03-20 00:56:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9afd7a720eaa774dded826d72a4f9ce5 SHA-1: d187bcc1af7ff9e4a43104f358105c0b5cf8942b SHA-256: ddd19e3913babe9515d112fb8e107a7c10245ad51b0c4e1f03963978ff2c757c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a suspicious domain, likely intended for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to 'Bruno Mars piano sheet music easy'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=bruno+mars+piano+sheet+music+easy
    • https://static.s123-cdn-static.com/uploads/4427105/normal_5ff3358a22f7b.pdf
    • https://cdn-cms.f-static.net/uploads/4389585/normal_603b2ceee5288.pdf
    • https://cdn-cms.f-static.net/uploads/4419827/normal_6039f94f67f3f.pdf
    • https://rovalexi.weebly.com/uploads/1/3/4/5/134598456/mimuvemas.pdf
    • https://cdn.sqhk.co/ludibipimilu/vgj6vhe/69804582254.pdf
    • https://cdn.sqhk.co/vilonunufuk/ifDRDKz/zolagejemuzox.pdf
    • https://cdn.sqhk.co/xuxofidipo/ij2XOpu/53340073915.pdf
    • http://wotukujis.sportsontheweb.net/86678906289.pdf
    • https://pamesatigifimes.weebly.com/uploads/1/3/4/6/134639420/benosoj-sozapuzawamuge.pdf
    • http://wikotimu.scienceontheweb.net/62560617246.pdf
    • https://cdn-cms.f-static.net/uploads/4487897/normal_6021015945f9f.pdf
    • http://lazisirogabidir.mypressonline.com/baixar_creator_adobe.pdf
    • https://cdn-cms.f-static.net/uploads/4366646/normal_603ac21974dda.pdf
    • http://gixodugesu.medianewsonline.com/who_makes_huskee_mowers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zedowep.atwebpages.com/model_code_of_judicial_conduct.pdf
    • http://pofijiserige.onlinewebshop.net/99291458373.pdf
    • https://uploads.strikinglycdn.com/files/6760e109-449d-45ed-820f-0ae97d75dbab/91844877078.pdf
    • https://uploads.strikinglycdn.com/files/b57d6920-5959-44cd-93df-71ce17478c50/husqvarna_chainsaw_450_rancher_chain.pdf
    • http://wesatume.atwebpages.com/bearing_types.pdf
    • https://uploads.strikinglycdn.com/files/45cf2c21-1b03-4b41-b107-b2aa1dcd34bf/why_do_vegetarians_not_eat_eggs.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010286.bin
f002081efb07e60b141db52033690311623d4a32bd5227be128c3945db1b8bf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10286 5292 bytes
font_01_sfnt_off0001145f.bin
3ec2bdac38c209dd866ad3ea6a398d7e1360ec41579d503bbd7f2de61b571034		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1145F 11500 bytes
font_02_sfnt_off00013b0a.bin
84650fe671c70ac66f3af0994468c9b9feb42d01905b0f030d5781e095ef8e52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B0A 16100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.