Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1f2f8be2643ac17…

MALICIOUS

PDF

88.6 KB Created: 2021-06-01 02:35:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d57366bdc92b8459d32263accff7f37d SHA-1: 27ffee7a00da92bfc8ec942c7b5e9a8ffee47031 SHA-256: e1f2f8be2643ac17d28d80c5dcc059c93736fee96f2513bc093a0ba6fe06b902
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://nomylo.ru/pbw?utm_term=samsung+smart+tv+remote+control+pointer+not+working', which is likely a phishing lure. The document body, though heavily obfuscated, contains text related to 'Samsung smart tv remote control pointer not working', suggesting a pretext for the malicious link. No scripts were extracted, but the presence of an external URI and the phishing-like content strongly indicate a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/pbw?utm_term=samsung+smart+tv+remote+control+pointer+not+working
    • https://static.s123-cdn-static.com/uploads/4372378/normal_600809a278e9e.pdf
    • https://cdn-cms.f-static.net/uploads/4462354/normal_6018845bc5e21.pdf
    • https://cdn-cms.f-static.net/uploads/4388280/normal_601db65b00796.pdf
    • https://cdn-cms.f-static.net/uploads/4476446/normal_60643dfddef07.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://siwuromo.pbworks.com/f/pool_billiards_pro_8_ball_game_apk.pdf
    • http://xoxafepapesu.pbworks.com/w/file/fetch/144411585/zurudilufobalapabowu.pdf
    • http://degenazi.pbworks.com/f/rebel_racing_mod_apk_unlimited_money_android_1.pdf
    • http://palixazoke.pbworks.com/w/file/fetch/144415839/96313158338.pdf
    • https://uploads.strikinglycdn.com/files/028b747d-cf12-4d47-bbbc-075cb0e37d34/clover_pos_system_for_sale.pdf
    • https://uploads.strikinglycdn.com/files/1a3bf4e9-505e-42ef-bc85-88c6efe21f37/how_to_use_dewalt_dws780.pdf
    • http://poxanoralanu.pbworks.com/w/file/fetch/144422268/nufevoj.pdf
    • https://uploads.strikinglycdn.com/files/ad08b914-af0f-457e-a99b-1e3ac98acf31/fojepalebebo.pdf
    • http://didaneguk.pbworks.com/f/69852545501.pdf
    • http://xojifot.pbworks.com/w/file/fetch/144423855/stres_ynetimi_ve_fke_kontrol_ppt.pdf
    • https://uploads.strikinglycdn.com/files/428de74f-4dd2-448c-9fc1-4ac83e99791a/house_of_night_otherworld_loved.pdf
    • https://uploads.strikinglycdn.com/files/e3bcb120-485d-449f-a7aa-ca176d1058a0/how_to_use_disk_drill_for_iphone_on_windows.pdf
    • https://uploads.strikinglycdn.com/files/0155af29-93c0-4fb9-83a0-fc65f7e58c90/snow_white_and_the_seven_dwarfs_story.pdf
    • http://didaneguk.pbworks.com/f/55416968596.pdf
    • https://uploads.strikinglycdn.com/files/00494435-6914-4736-a786-318651feaa84/95695095523.pdf
    • https://uploads.strikinglycdn.com/files/1253d268-731c-4392-9301-4668c921a6b1/dezukokidor.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6a9.bin
75367ab252fa4435b189832be96e4ec606f8f8589b1cb7f22831ad3782a0fe10		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6A9 5456 bytes
font_01_sfnt_off0001092f.bin
5dbf2dabecc56152a360bf7c5c5b2cc657f19b47f36e1c5f7444bd3de2cc0ccc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1092F 11208 bytes
font_02_sfnt_off00012fa9.bin
39c7f27a86fdd55ccb8bf5ca5bf9f8a436ffa3574a4bd78d3cd2104f95afcfa3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FA9 16704 bytes
font_03_sfnt_off000145c4.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145C4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.