Malicious PDF — malware analysis report

Static analysis result for SHA-256 e733a397e3d3abcd…

MALICIOUS

PDF

85.5 KB Created: 2021-03-22 07:05:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c0f58053c1ea631bcf910de9853cb80 SHA-1: 53348c450cbaec62515b7d4efb620a5b34cd39fa SHA-256: e733a397e3d3abcda432a99fe0acd470d31f1ff9e0f77637fa3f85e49ee82a6d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a malicious site for further exploitation. The document body, though heavily obfuscated, suggests a lure related to construction cost estimation, aligning with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9887

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=estimation+and+costing+of+commercial+building+pdf
    • http://noverst.xyz/minecraft_how_to_render_fasterg9kxf.pdf
    • http://jilavixit.medianewsonline.com/wagipuzikubiposijinedo.pdf
    • http://circulshtangcalip.website/supernatural_castiel_death_scene8o8bb.pdf
    • http://show-visitor.xyz/can_hydrogen_peroxide_heal_woundst6mzj.pdf
    • http://itash.space/tabawinaln2c3.pdf
    • http://helpforteam.com/bakupowanejuxotubamowemim0jkmn.pdf
    • https://pabametutib.weebly.com/uploads/1/3/5/3/135317572/94c8e.pdf
    • https://jiromozuno.weebly.com/uploads/1/3/5/3/135387519/e6799.pdf
    • http://muxoman.mygamesonline.org/workbench_plans_free.pdf
    • http://gemofesane.medianewsonline.com/zefikoxiw.pdf
    • http://doordash.fun/23067616262krc6w.pdf
    • https://tarebizadutobi.weebly.com/uploads/1/3/4/3/134310067/b484ed.pdf
    • http://levitajagukog.scienceontheweb.net/5700860504.pdf
    • http://simopuvoramawu.mywebcommunity.org/how_can_i_get_my_drivers_permit_during_covid_19.pdf
    • https://cdn-cms.f-static.net/uploads/4410000/normal_603e2db9a2d36.pdf
    • https://cdn-cms.f-static.net/uploads/4411220/normal_604d0222696e1.pdf
    • https://vanunogagasibe.weebly.com/uploads/1/3/5/9/135964710/300782.pdf
    • https://static.s123-cdn-static.com/uploads/4370054/normal_600011f9506f5.pdf
    • http://opros.xyz/minoruluzunajukajawifedez7q1pj.pdf
    • https://cdn-cms.f-static.net/uploads/4447646/normal_605352ad62c38.pdf
    • http://mishgen.com/5_reliable_and_unreliable_sources_of_health_information_and_productsdrblx.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • http://www.daltonmaag.com/
    • http://vebuluxuj.rf.gd/68966315297.pdf
    • http://linakagiwabofa.epizy.com/colorear_lol.pdf
    • http://najizomixa.rf.gd/bubble_trouble_2_free.pdf
    • http://nekipusixewid.epizy.com/turejexewexisas.pdf
    • http://risogida.rf.gd/18016914984.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efb6.bin
9857214ece38fedc8192d5c56dae5cb89f4d277a5be55172345d17c4a6d47f0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFB6 5456 bytes
font_01_sfnt_off00010216.bin
1377c3b91b72eeaef1bb4451c8cfd21ddcd6ab4365ecf1ad874393a77f7bc3e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10216 6636 bytes
font_02_sfnt_off000113af.bin
2a28f8d4fa531d5573f31fd4f5b5e9153ed35716ab197ecf9685356fda001c5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113AF 10980 bytes
font_03_sfnt_off000138fd.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x138FD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.