Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddfac49dfaf74501…

MALICIOUS

PDF

74.4 KB Created: 2021-03-12 17:43:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 467084c7d32fde99a436b021b3929db8 SHA-1: 9f44bbfac4fc6a75a767ed528dd61877da98b48c SHA-256: ddfac49dfaf745012ef4fcdc3494ef6f5efc9fa61e3990bcba390fab56d3121a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a 'programme botola pro 2020 pdf', aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=programme+botola+pro+2020+pdf PDF link annotation
    • http://dowotezovemalo.mygamesonline.org/3318859236.pdfIn PDF document text
    • http://fijigud.22web.org/brother_serger_1034d_instructions.pdfIn PDF document text
    • http://wutanumijejol.sportsontheweb.net/mufilisol.pdfIn PDF document text
    • http://pevelumi.22web.org/how_fast_does_a_49cc_taotao_scooter_go.pdfIn PDF document text
    • http://kanshoper.site/jawbone_speaker_not_connectingp17g8.pdfIn PDF document text
    • http://mmuuue.space/45630279798miue.pdfIn PDF document text
    • http://infonewstravel.com/smart_locator_app37xxn.pdfIn PDF document text
    • http://xoxuvajes.mywebcommunity.org/air_force_academy_requirements_act.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kusababi.onlinewebshop.net/puluxajud.pdfIn PDF document text
    • https://s3.amazonaws.com/suzujewa/nutatuwutekofomixiwavasu.pdfIn PDF document text
    • https://s3.amazonaws.com/xisefowu/xuxijejakabobi.pdfIn PDF document text
    • http://dinopug.epizy.com/cuantos_litros_son_1_metro_cubico_de_agua.pdfIn PDF document text
    • https://s3.amazonaws.com/genijusemu/bbs_2nd_year_result_2075_with_marksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/bededuxotulapil/star_spangled_banner_sheet_music_for_flute.pdfIn PDF document text
    • http://wenibeliso.atwebpages.com/sogulolelajilageg.pdfIn PDF document text
    • https://s3.amazonaws.com/lolaritemukole/lukes.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/2007_honda_fit_sport_owners_manual.pdfIn PDF document text
    • http://desiwafinu.epizy.com/34158109424.pdfIn PDF document text
    • https://s3.amazonaws.com/pojikovewijeja/34895599719.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d82f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD82F 5596 bytes
SHA-256: cccbbcabb338d84c2a4cbdf576aaff772933cc27c3975a9152a4879f6e37afeb
font_01_sfnt_off0000eb20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB20 16008 bytes
SHA-256: 58b048d0c191991842043b438c574b388ed1ccf078d4a77d22c074615e27d22e

Open this report in the interactive analyzer, or submit your own file for analysis.