Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4dc0da50f3de5df…

MALICIOUS

PDF

113.0 KB Created: 2021-05-29 03:11:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: d34c74b3330300206fd633cc0d381a83 SHA-1: e5cc5dcccb31dfc9fd2cdd53d8f61205aa6ce79e SHA-256: e4dc0da50f3de5dfdc05d56b9ade0dc160a51b09bade9107561ecaa5bec25bd8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL pointing to 'maypoin.ru', which is likely the distribution point for a malicious payload. The document body is heavily obfuscated and appears to be a lure related to French grammar, likely to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=4+types+de+pronoms+personnels PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4377112/normal_6044def35090d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451565/normal_5fe6f0cfaacd1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406466/normal_60392f4c1e185.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382948/normal_6008ef4308b77.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e9a48d7-546f-4c9e-8878-2ad67bce149e/ti_nspire_cx_cas_software_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ddc741c-d80e-448b-90cb-8144464146c4/papiwun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60d5bc1b-6568-49ce-8c54-4ecbe222cf61/rojilap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73d420bf-6460-4769-823e-a085385ce425/velitixati.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/714f7dc2-8fef-4963-b010-907d68e09f33/50844125718.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/476a146d-7e5f-4091-9de0-4f08d81c89a2/24523476479.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06d2d0fa-cd88-4067-88ec-68268915cdad/mirepuvosozewepadalonovo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4961ea54-e978-426c-8081-7610169e348d/31657374173.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed74a7a8-e61c-485f-909a-f23cc0e597ee/solution_of_simultaneous_linear_equations_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f139a083-b718-4524-9dd2-3e973cece041/windows_8.1__windows_10.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e7cf139-924f-4829-aa3e-4e357292de05/stephen_kings_it_movie_1990_watch_online_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000161e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x161E7 4988 bytes
SHA-256: 3517a58b9f64c32f3d2891b2ba20368ce8a902922ae35cb0ff79fc55c8a18d18
font_01_sfnt_off000172d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x172D6 15124 bytes
SHA-256: 70e6f71aeb0bc189304e69df74b054ba2bc5a0663853cd5bcd9402ba35a1eea5
font_02_sfnt_off0001a0b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A0B8 16060 bytes
SHA-256: 5b0d2701ab39d2f69c66d7d16c60d8db0b323aa0832947137e757b5401d27330

Open this report in the interactive analyzer, or submit your own file for analysis.