Malicious PDF — malware analysis report

Static analysis result for SHA-256 e44be8fc48ba9f09…

MALICIOUS

PDF

71.0 KB Created: 2021-03-18 09:10:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 734feeb2b0957a27bad07839e0e84fca SHA-1: db840c309fe1946c79466755858a47044598616a SHA-256: e44be8fc48ba9f090cde9c2ee13b80601fba1ccf10ae8e38b8fc5790ff325491
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URL pointing to 'maypoin.ru', which is likely part of a phishing or malware distribution scheme. The document body's text suggests a lure related to 'freeloader crossword answers', aiming to trick the user into interacting with the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=freeloader+crossword+answers
    • https://suzazenesegi.weebly.com/uploads/1/3/0/7/130776168/wexezazudogofa.pdf
    • http://sodowetan.mywebcommunity.org/25170772122.pdf
    • https://cdn-cms.f-static.net/uploads/4421049/normal_5fe79e5c7af9c.pdf
    • https://cdn-cms.f-static.net/uploads/4369190/normal_5fd1b89ebe47f.pdf
    • https://cdn.sqhk.co/xoraxuvonaf/hbmjVrX/standoff_multiplayer_mod_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4457592/normal_5fd5f62580ee4.pdf
    • https://nulivuxod.weebly.com/uploads/1/3/0/7/130776854/4151084.pdf
    • https://jajaleregonu.weebly.com/uploads/1/3/4/2/134235513/5547770.pdf
    • http://vurujupafowutox.mypressonline.com/bivajogukokuvufulekigoxur.pdf
    • https://dubiriji.weebly.com/uploads/1/3/1/4/131406762/padoviguv_muxilinela_javewiniwebew_doginese.pdf
    • https://cdn.sqhk.co/goseluna/zihhcha/repifogijosezajow.pdf
    • https://cdn.sqhk.co/lasotepana/6KTkjh3/download_game_dome_of_doom_offline_apk.pdf
    • https://lexugorubu.weebly.com/uploads/1/3/0/7/130776619/817b2f21a46e.pdf
    • https://static.s123-cdn-static.com/uploads/4501482/normal_5fdeb9a189cd4.pdf
    • https://cdn.sqhk.co/surikuzezun/viegfiV/channel_impulse_response_matlab.pdf
    • https://tirusagoxavux.weebly.com/uploads/1/3/5/3/135329940/bejux.pdf
    • https://kofudisefases.weebly.com/uploads/1/3/4/0/134018526/tufopukatexutudu.pdf
    • https://static.s123-cdn-static.com/uploads/4492245/normal_5ff5f79c49028.pdf
    • https://xonarupitowij.weebly.com/uploads/1/3/4/6/134617661/363a4be36e5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/lulelepese/9289490924.pdf
    • https://s3.amazonaws.com/gezetega/doterra_product_guide_2019_australia.pdf
    • https://s3.amazonaws.com/jivamubug/wakagulajup.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc19.bin
281576cd8c2341c8f06c3947bacd1541f778e67aedf0ff132eacc06d160fb5f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC19 4640 bytes
font_01_sfnt_off0000dbea.bin
6cfe6b9cf6447d3a35148e773080c5c0ac83ca46de9ddd91a7a6821d1c496a16		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBEA 10772 bytes
font_02_sfnt_off0001008f.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1008F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.