Malicious PDF — malware analysis report

Static analysis result for SHA-256 e35dc0b301250b20…

MALICIOUS

PDF

102.8 KB Created: 2021-05-10 04:51:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8b1f39e5282f2e95c6965e0f921f9b0f SHA-1: 5fb8f806083fca2fdcc0631377f311eca2b9f88d SHA-256: e35dc0b301250b20e530510e3d8c549b5573a166b5d3075b5e1aca358bd0bb30
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to suspicious PDF files hosted on compromised websites. The document body, though heavily obfuscated, appears to be a lure related to a book title, likely intended to trick users into clicking the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://eduinfinite.com/wp-content/plugins/super-forms/uploads/php/files/ebde760d32135bd31b9c949f359df0bf/zavojedulubozul.pdf
    • https://alianzatours.com/imagenes/file/87563272047.pdf
    • https://www.ergunaygoren.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607054a438fae---48565175489.pdf
    • http://math-talk.kr/wp-content/plugins/super-forms/uploads/php/files/hnr90pm2kgkfv44bd70b5c43h1/73955610967.pdf
    • https://www.mybizwebsites.com/wp-content/plugins/formcraft/file-upload/server/content/files/160833a08785ab---wuzewadasetebudutatire.pdf
    • https://gulertrafik.com/wp-content/plugins/super-forms/uploads/php/files/srs36ptmr002fkbmpsnriqtutf/lupawojugat.pdf
    • https://www.varisistanbul.com/wp-content/plugins/formcraft/file-upload/server/content/files/160729c7ebc38e---18044541418.pdf
    • https://earplighting.com/wp-content/plugins/super-forms/uploads/php/files/cd7cd2488218bc115c69d0fcd34c2b6b/rafavoredegumabukanosapu.pdf
    • https://samiznojmo.cz/wp-content/plugins/super-forms/uploads/php/files/e0204e24c5f34c4bc10f003a12b96a56/kumanavefabom.pdf
    • https://centar-znr-zop.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160987b3ccaa16---xewiniwoziluvuregumexoma.pdf
    • https://amatnieks.com/pictures/image/83465928066.pdf
    • http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/1607986c5dbfa2---26281378207.pdf
    • https://alismobile.co.uk/wp-content/plugins/super-forms/uploads/php/files/fbed08a714e6d036a1f366093942f7d9/gozamefunowipuminav.pdf
    • http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/16089753cdf2a6---16144308948.pdf
    • https://thejasmineway.net/wp-content/plugins/super-forms/uploads/php/files/3rbliaus83etu7j2p99c041i9j/puloban.pdf
    • https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/a4537a4b85f8f3c2b8cef09b83ea0d2f/tevutulapizexemuzawon.pdf
    • https://www.kcequipment.com.au/wp-content/plugins/super-forms/uploads/php/files/ddf9ddccf9aa640544f9f8b602d3946b/vulibatek.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=behold+a+pale+horse+book+free
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014aac.bin
80ea3c132dd4b18bf2eaf4902a4daefc551c2d819df3548f79b8100ea87a0881		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14AAC 5384 bytes
font_01_sfnt_off00015ce6.bin
92b10d09e1e99212c421f3157e964a97a52586f622ba5b64d5bd45e214ea3811		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15CE6 2412 bytes
font_02_sfnt_off00016796.bin
87007c3a538a668639b5c7c2472431e09e1263d3f4ee52392eeceac2dd0c5ac6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16796 10852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.