Malicious PDF — malware analysis report

Static analysis result for SHA-256 e479e411b1a0f276…

MALICIOUS

PDF

79.4 KB Created: 2021-03-29 10:35:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a842a2ad3606079c02faeebfe9a13aae SHA-1: 2ca69442a2d9e46f05249e35b57539e348bb11e9 SHA-256: e479e411b1a0f276bdf51881e5d35e1849e6ab6fd410cca4d74adf8dde275571
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly flagged this PDF as malicious. The presence of an external URI and the overall detection suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=2003+jetta+2.0+transmission+fluid+check
    • https://cdn.sqhk.co/zolulesar/exBsigY/hakuoki_edo_blossoms_walkthrough_hijikata.pdf
    • http://teagreen.space/life_is_a_journey_quotes_for_instagrama9bxv.pdf
    • http://noksipals.online/sudowiraxafavijefjjy7u.pdf
    • https://cdn.sqhk.co/fagaxirupunu/I2jiGgg/tom_and_jerry_movie_2021.pdf
    • http://myluckywin.site/wulabagujebadifiwo17fw.pdf
    • https://cdn.sqhk.co/kivipemo/Coljfza/20686375296.pdf
    • http://giwewigipebi.medianewsonline.com/dewipilidowafazegiwel.pdf
    • https://cdn.sqhk.co/naxenunovus/ijwTGjh/read_music_notes_violin.pdf
    • https://cdn.sqhk.co/zowolanazew/gjcjfgi/wolf_wallpaper_iphone_tumblr.pdf
    • http://ludesajezopaju.medianewsonline.com/rakipaberikem.pdf
    • http://help-violation.com/abwaan_gaariye0q0eh.pdf
    • https://cdn.sqhk.co/xopewina/chbU6WZ/viva_video_mp4.pdf
    • http://excschool.ru/48231463818cthzd.pdf
    • https://cdn.sqhk.co/moturalogupe/g9LXexH/guide_for_free_fire_coins_and_diamonds.pdf
    • http://nulatapukedu.scienceontheweb.net/56346075686.pdf
    • http://vobalemujumojak.mywebcommunity.org/cardiopatia_isquemica_cronica.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/timeziso/vidovo.pdf
    • https://s3.amazonaws.com/rirusozo/tusawojakin.pdf
    • https://s3.amazonaws.com/xeruxaxer/free_brave_browser_for_android.pdf
    • https://s3.amazonaws.com/minaxigevani/quadra_fire_classic_bay_1200_insert_parts.pdf
    • https://s3.amazonaws.com/lupebesu/buckram_hat_forms_victorian.pdf
    • https://s3.amazonaws.com/devuxuzejozam/jomolibesew.pdf
    • https://s3.amazonaws.com/tobojelusiwi/sowuwafanidurobar.pdf
    • http://jabodegodonirad.atwebpages.com/tiger_rice_cooker_jbv-a10u_instructions.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebba.bin
78dd663e3c649ae2986cd3771e3e31e00795539330975b061bf4265171a49ceb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBBA 5656 bytes
font_01_sfnt_off0000feb9.bin
ee34eb86c15d58f6f72b5ff3b64e75bdddea5c7a8c0acccd4d7e64a418664a30		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEB9 10268 bytes
font_02_sfnt_off000121d7.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121D7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.