Malicious PDF — malware analysis report

Static analysis result for SHA-256 e57344e300c52ee5…

MALICIOUS

PDF

84.0 KB Created: 2021-03-26 00:02:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 590b7ca2287f2db8dbc5bcbc3e261245 SHA-1: f0b997ee34dab772324906ad8101b6008e1f79eb SHA-256: e57344e300c52ee5007e94b93e4a605b2c93e05dcd6aa9b8797de457306a6011
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to a suspicious domain, likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, contains text related to 'jquery form submit button ajax', suggesting a lure to trick users into visiting the linked site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=jquery+form+submit+button+ajax PDF link annotation
    • http://polypak.site/davis_drug_guide_online_freejxkk8.pdfIn PDF document text
    • http://energierecrute-emplois.com/how_to_take_a_practice_ged_test_onlinenb4bg.pdfIn PDF document text
    • http://mstmail.space/22509173966gqhsv.pdfIn PDF document text
    • http://rosativiwam.mypressonline.com/sumarubij.pdfIn PDF document text
    • http://luxibenuguk.getenjoyment.net/booth_wise_election_result_haryana_2020.pdfIn PDF document text
    • http://topchambre.xyz/jiselogiximabu7afuk.pdfIn PDF document text
    • http://filmera.ru/c_async_programming_guide0fsiu.pdfIn PDF document text
    • http://bio-ita.fun/nukajudiboputovejoxesime63wkm.pdfIn PDF document text
    • http://salea.site/robotek_bluetooth_headphones_pricetcr8b.pdfIn PDF document text
    • http://dommasters.site/777208070338v7d5.pdfIn PDF document text
    • http://marketeuro.pro/975838219101vxod.pdfIn PDF document text
    • http://localdesign.me/41307916326miyk1.pdfIn PDF document text
    • http://lightstart.xyz/mowimavif4kssb.pdfIn PDF document text
    • http://itwow.info/sector_14_noida_pin_code_numberzm6g2.pdfIn PDF document text
    • http://ins.expert/bagorusogebimabubiwidajaxi9zh.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bogeguva/dictionnaire_conomique_anglais_franais.pdfIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/8276602496.pdfIn PDF document text
    • https://s3.amazonaws.com/rutufokedizon/bajaj_allianz_health_insurance.pdfIn PDF document text
    • https://s3.amazonaws.com/bomifabipi/lajiluja.pdfIn PDF document text
    • https://s3.amazonaws.com/nilititonawafim/7th_grade_math_algebra_1_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/tomamujuf/can_i_teach_myself_to_mig_weld.pdfIn PDF document text
    • http://lobopekogolo.onlinewebshop.net/les_amplificateurs_oprationnels_exercices_corrigs.pdfIn PDF document text
    • http://nevabaza.atwebpages.com/article_about_child_and_adolescent_development.pdfIn PDF document text
    • https://s3.amazonaws.com/genijusemu/54922064642.pdfIn PDF document text
    • https://s3.amazonaws.com/fixararololu/bandit_queen_movie_in_hd.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010450.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10450 5384 bytes
SHA-256: 70ed417fc474a5785225322a64715f7a93d8e3d3219c114d2848ed1a2c8ec796
font_01_sfnt_off000116a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116A1 13304 bytes
SHA-256: 4b8e9aa80192c24072829a53fb4b13d8b5e7fc4d73ac5602a6fde657eb61a9e6

Open this report in the interactive analyzer, or submit your own file for analysis.