Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1003bd799d49ddd…

MALICIOUS

PDF

82.9 KB Created: 2021-03-22 21:27:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 258b5e183328d2301d919af36ea73af5 SHA-1: 5b34b57db33e52078c613c8c0b3731550a9e501c SHA-256: e1003bd799d49ddd0b049b1c278dd9122bcd7d0596137f15f2d5c109d0446ef3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that points to a suspicious domain, likely intended for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, contains text related to a search query, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=human+skeleton+labeled
    • http://vowufijetapiko.sportsontheweb.net/83724734818.pdf
    • https://cdn-cms.f-static.net/uploads/4474998/normal_60114b21a3e1c.pdf
    • https://cdn-cms.f-static.net/uploads/4405430/normal_6045e4540f927.pdf
    • https://static.s123-cdn-static.com/uploads/4463286/normal_5fdf18fa74182.pdf
    • https://cdn-cms.f-static.net/uploads/4388037/normal_604d1ac0b35a0.pdf
    • https://cdn.sqhk.co/vurifozi/gpjc4wQ/minecraft_latest_version_1._14_free_pc.pdf
    • http://zovolexune.sportsontheweb.net/wadifogilijorifodejip.pdf
    • http://dilawiputonu.mypressonline.com/frosty_the_snowman_original_song_lyrics.pdf
    • https://cdn-cms.f-static.net/uploads/4373509/normal_60127b5d280da.pdf
    • https://cdn.sqhk.co/gogerazina/mSgejcg/shootout_basketball_arcade_game_home_dual_shot.pdf
    • https://cdn.sqhk.co/gabogivoxavi/ejjhdhh/29022600424.pdf
    • https://static.s123-cdn-static.com/uploads/4369659/normal_5ffa2651192a9.pdf
    • https://cdn.sqhk.co/libibajuzumu/hcpYA29/50581183743.pdf
    • https://cdn.sqhk.co/garoresolif/dZLQhiB/winotepumuligovisuvis.pdf
    • http://pixidilivutep.medianewsonline.com/msrtc_advertisement_2020.pdf
    • https://cdn-cms.f-static.net/uploads/4450141/normal_602e1c8d45b13.pdf
    • http://zugapib.22web.org/jumupajafar.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bavajozobe.epizy.com/9383147274.pdf
    • http://mewexam.epizy.com/gokuxawazerufefekivive.pdf
    • https://uploads.strikinglycdn.com/files/5f45ff61-9f52-4826-9ccc-86306f4c366c/who_was_enoch_in_the_bible_kjv.pdf
    • https://uploads.strikinglycdn.com/files/6a537a2c-b68f-4f7c-aa86-2590800535bf/womulanex.pdf
    • http://gujusama.rf.gd/business_card_mockup_file.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb40.bin
d11710a6a3c9f7bb0ecf5bd26236092e44f7643b7dd1ef6a9c71dda12acb4748		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB40 5040 bytes
font_01_sfnt_off0000fc49.bin
da21eb9ab6b7aa90df36da7ce4808b06f9b4629318c074c058761e5f6aad692c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC49 10828 bytes
font_02_sfnt_off00012191.bin
0b37e4f7f3e6d5417dda5ba44a401f324d1a12703f9499dd248b38ccc5778237		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12191 17828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.