Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4362e3a4ae41092…

MALICIOUS

PDF

800.0 KB Created: 2021-03-08 04:13:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: cb12b8ac3852bcb64bf396a579f29b9b SHA-1: 729fc7cf6d27a8231bbd04f85819c917e57c97c7 SHA-256: e4362e3a4ae410925f7030a166fca593e7e054c5fbda082ad3c5faf043acfd0c
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs that lead to suspicious domains, suggesting it is part of a phishing or malware distribution scheme. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this. The document body, though heavily obfuscated, appears to be related to search terms for academic papers, indicating a lure to trick users into downloading malicious content.

Machine Learning

  • Nyx PDF Classifier clean score 0.1618

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/aws?utm_term=analysis+of+transport+phenomena+deen+2nd+edition+pdf+download PDF link annotation
    • http://fastdonwload.space/bloons_td_5_free_iphone_downloadt0zne.pdfIn PDF document text
    • http://www19216801.site/cuantos_dias_de_feriado_legal_tiene_un_trabajadoreenbh.pdfIn PDF document text
    • http://rafewasugajeze.22web.org/sewisowakugivi.pdfIn PDF document text
    • http://rebituzugofebo.22web.org/samsung_hm1350_specification.pdfIn PDF document text
    • http://esplus.pro/can_you_take_the_asvab_online_at_homepgt3p.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426966/normal_601c970ed15e0.pdfIn PDF document text
    • http://zoziwasikow.22web.org/avadh_university_degree_application_form.pdfIn PDF document text
    • http://armlur.space/what_is_the_book_of_jubilees1woka.pdfIn PDF document text
    • http://vovality.club/communist_flag_gifwpmgi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450041/normal_5ff0278f38dde.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_e452eeeb81df4763ba985b26a6dc96f9.pdf?index=trueIn PDF document text
    • https://a581e706-3bf6-41fb-8978-ad4d4077590d.filesusr.com/ugd/afbe6b_17804404d9274ca5b088e8dd0084f2fe.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kumasala/nisamonumatupamu.pdfIn PDF document text
    • https://b03e51a8-7171-48c0-94d6-e4c032e6f37f.filesusr.com/ugd/9421c8_2d0f709acc4a440a9cb6c5d8dbb7b16b.pdf?index=trueIn PDF document text
    • https://36425c1f-c329-48aa-845d-1f8252cb45c8.filesusr.com/ugd/01d500_17228e05d33640538386108205a18db1.pdf?index=trueIn PDF document text
    • https://bf23b77b-49a9-4bef-a898-a03cfb94aefa.filesusr.com/ugd/134172_7e8a886e63174d6d94ffd3d93bc961bd.pdf?index=trueIn PDF document text
    • https://c96d0889-97fb-4213-90a4-a08ae01970e6.filesusr.com/ugd/ed32f2_980f6c7680e341829445f26244607152.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jugobimuraje/experimental_parasitology_guide_authors.pdfIn PDF document text
    • https://19508648-7f28-415f-8121-b57715dc1465.filesusr.com/ugd/9734e7_a0756dff874646bfa804b4c6a1ad487c.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000c0480.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC0480 5384 bytes
SHA-256: beb3d582b179a4dbe51af6ee5d4d2bbcff5e06ddab2faa98457dee23a1f49e30
font_01_sfnt_off000c16bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC16BC 14580 bytes
SHA-256: c8a0a2c2deaa014f17c56d4dffdd286c0bbe48adc657a449ec909ea52d1082c1
font_02_sfnt_off000c47a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC47A9 16060 bytes
SHA-256: 3a2bb6651a5ad642813d1e324805fe83a688734d44fd23e014c0665a2602df32
font_03_sfnt_off000c5c47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5C47 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.