Malicious PDF — malware analysis report

Static analysis result for SHA-256 e79433ecc4a3892d…

MALICIOUS

PDF

70.2 KB Created: 2021-04-03 15:01:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: fc6eed1414073f4b180e06990e91428e SHA-1: 3f57d305139c8857236d32022c31cae0e2472a05 SHA-256: e79433ecc4a3892dbdb25eea9ac5f2c7820dafd0719cac0adb71222fa7a5abd3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL pointing to 'fokemale.ru', which is flagged as suspicious and likely leads to a phishing or malware distribution site. The document body, though heavily obfuscated, contains text related to a BMW garage door opener, suggesting a lure to entice users to click the malicious link. ClamAV detection and ML classification strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=how+to+set+garage+door+opener+in+bmw+328i PDF link annotation
    • http://praktika-ingenieur.com/toguliwelodakibog2hws2.pdfIn PDF document text
    • https://lijotabele.weebly.com/uploads/1/3/4/0/134016876/80906475f.pdfIn PDF document text
    • http://zuxemesemubozo.mywebcommunity.org/43901051528.pdfIn PDF document text
    • https://sunajojafexa.weebly.com/uploads/1/3/1/8/131856627/8424f.pdfIn PDF document text
    • http://ing-cliente.com/juvuvegilafavalifibiza4cht1.pdfIn PDF document text
    • https://sazezikamujut.weebly.com/uploads/1/3/1/4/131438312/59ab023257b.pdfIn PDF document text
    • http://mavafesumej.medianewsonline.com/70933368144.pdfIn PDF document text
    • http://wufamega.scienceontheweb.net/52829011336.pdfIn PDF document text
    • https://gebawifu.weebly.com/uploads/1/3/1/4/131483167/745320.pdfIn PDF document text
    • https://fezagexagowib.weebly.com/uploads/1/3/5/3/135313062/tunadu.pdfIn PDF document text
    • https://cdn.sqhk.co/letarezetap/CDWhbqq/bamogapewinifusofenarilog.pdfIn PDF document text
    • https://cdn.sqhk.co/pasepizut/GFieJig/28713503873.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pafiganovavi/academic_council_formation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0dddd8a3-5229-4e17-8276-3c5236f51652/xupusasevufutiziwadas.pdfIn PDF document text
    • https://s3.amazonaws.com/woxotopapozokev/90539962993.pdfIn PDF document text
    • https://s3.amazonaws.com/nosepevozux/mutaguvutetimijekojiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f346e87-1f9e-4fba-ae61-4b5bf66a57e2/92680740609.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2faf1e5-82eb-4f9d-981e-7faac7c09daf/do_you_have_to_read_diary_of_a_wimpy_kid_in_order.pdfIn PDF document text
    • https://s3.amazonaws.com/vojapu/92155423903.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1CD 5932 bytes
SHA-256: 9e943bc886294f9950cf16582a26bdac201c2301a0d3989f9e9a83e2b61ae42a
font_01_sfnt_off0000e5ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5EF 11020 bytes
SHA-256: 929b99789c8d08a056a83b095310c5322449b8446b510a77a690ed2fa229300e

Open this report in the interactive analyzer, or submit your own file for analysis.