Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6aee14f879e38f5…

MALICIOUS

PDF

77.1 KB Created: 2021-03-31 06:56:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1311e0cb49edc8fdecc0096f612a49ee SHA-1: 5a518d20ca2c523d7132f5c18d4a2a10cf6b2afb SHA-256: e6aee14f879e38f5140939c6ce252aaa423bdd56bbee7aaecc0ff0713b16928c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link disguised as a movie download, which leads to a malicious domain. ClamAV and ML classifiers identified this file as malicious, specifically a phishing trojan. The embedded URL is the primary indicator of this phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=toy+story+4+full+movie+free+download
    • https://cdn-cms.f-static.net/uploads/4369164/normal_603626c609897.pdf
    • https://static.s123-cdn-static.com/uploads/4419204/normal_5fecbf49389c8.pdf
    • https://cdn.sqhk.co/jimevexir/jfjhgdG/ddpai_mini_3.pdf
    • https://cdn-cms.f-static.net/uploads/4452618/normal_605d65af10fc3.pdf
    • https://static.s123-cdn-static.com/uploads/4413977/normal_5fe6011f5bd6b.pdf
    • https://cdn-cms.f-static.net/uploads/4391915/normal_601d5b7937f0f.pdf
    • https://cdn.sqhk.co/bepigulusibe/3Yqxbje/19922012978.pdf
    • https://cdn-cms.f-static.net/uploads/4474734/normal_60235ee816ec4.pdf
    • http://mawidoxejonej.iblogger.org/wings_of_fire_bengali_version_download.pdf
    • http://fogarapisow.22web.org/the_magus_fowles_movie.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f9cb7010-568c-45d0-b0a5-7bd630b60272.filesusr.com/ugd/b10ea2_46586450b71e4622977f676c5139da9d.pdf?index=true
    • https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_4ebb1c9dc06044f29475ee4a44b4411f.pdf?index=true
    • https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_4f2899069a63464cb04cc69a2ce35f16.pdf?index=true
    • https://s3.amazonaws.com/gisujubolidine/bukota.pdf
    • https://s3.amazonaws.com/juduk/xisipaguzarabu.pdf
    • http://vutuzirowu.rf.gd/fema_is_405_test_answers.pdf
    • https://s3.amazonaws.com/geraromu/cue_sheet_multiple_flac_files.pdf
    • https://s3.amazonaws.com/ximupuv/gebuzatudurokedemukemazu.pdf
    • https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_e32a96e398cf4e6f8c2c928cbe49a691.pdf?index=true
    • https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_abf3b5eec03b4eea9598cf78b4fde264.pdf?index=true
    • http://jazupizewatabal.epizy.com/calgary_zoo_map.pdf
    • http://jexukavelewin.rf.gd/binding_of_isaac_rebirth_all_transformations.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee40.bin
71a18d1e05bcb6e5397a9b0673f45a7ab7454269ca05c26cecf3143c1c82b6f3
pdf-font-stream PDF embedded font (sfnt) at offset 0xEE40 5344 bytes
font_01_sfnt_off00010074.bin
8a5d2455003228d3ec6d583fd924c24f33f990c7172ef4c208730a6d5c90cb90
pdf-font-stream PDF embedded font (sfnt) at offset 0x10074 11424 bytes