Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8b6a3e31d675149…

MALICIOUS

PDF

90.6 KB Created: 2021-03-22 12:24:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e9e5a0c021110681f05ffa084f0f6a29 SHA-1: aba34e56c19dfc14676b650deb22c290dcb4f9d7 SHA-256: e8b6a3e31d675149a85e18944130e62dd463e1d68527b938a7049b7c524cebe3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'https://maypoin.ru/123?utm_term=bts+dna+mv++mp4', which is a strong indicator of a phishing or malware distribution attempt. The document body is heavily obfuscated, but the presence of the external URI and the malware detection strongly suggest a malicious intent to redirect the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=bts+dna+mv++mp4
    • https://cdn.sqhk.co/zugivakizo/i7gdhj2/ant_or_bee_collective.pdf
    • https://cdn.sqhk.co/mogezunir/chhix1X/automatic_dog_ball_thrower_how_to_make.pdf
    • https://cdn.sqhk.co/xasurila/sjayrig/five_dice_free.pdf
    • http://fasadi.site/guardian_underground_fence_instructionsv5dil.pdf
    • http://biotringel.shop/huffy_bike_sizecp986.pdf
    • https://cdn.sqhk.co/petawelesup/Fjhgg0U/gladiator_rising_roguelike_rpg_mod.pdf
    • http://baltika-trans.ru/6808589262qo4fk.pdf
    • https://cdn.sqhk.co/tuwetebep/ijjbJid/roxowujawaxitipigiru.pdf
    • http://apkweb.net/lab_equipments_and_their_usesx6h5f.pdf
    • http://clientbluebadge.com/73239288704ixbqo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pusapovewazigu.onlinewebshop.net/96866110141.pdf
    • http://molagegivijoxu.onlinewebshop.net/72806228358.pdf
    • http://jowokepo.atwebpages.com/que_es_variabilidad_genetica.pdf
    • https://uploads.strikinglycdn.com/files/4393150e-bc85-4d55-a601-14ce019db2f7/p90x_workout_schedule_chest_shoulders_triceps.pdf
    • https://uploads.strikinglycdn.com/files/250817ac-9338-4a90-892b-b263c116f245/5.1_channel_home_theater_system_with_dvd_player_by_sylvania.pdf
    • https://uploads.strikinglycdn.com/files/7f56edff-27ab-4eae-befb-409f232111e4/70964696350.pdf
    • http://xuvuzonixo.onlinewebshop.net/govawesodapujoruwimegeve.pdf
    • https://uploads.strikinglycdn.com/files/e71a67e0-de77-4289-af28-1f633e409830/435536289.pdf
    • http://juludiripo.myartsonline.com/87270170017.pdf
    • https://uploads.strikinglycdn.com/files/a14e024a-2fd2-444b-bf1b-27f76a35a45e/viwuzuragexowanif.pdf
    • https://uploads.strikinglycdn.com/files/33cd5119-6c4d-43d6-af3a-eb6808886d39/best_games_for_logitech_extreme_3d_pro.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001243b.bin
0f59e877695d2692ec0d48027673258d8771762ca3476ea8d3104cc4d542b937		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1243B 5172 bytes
font_01_sfnt_off000135d5.bin
4f27cb94395793907dec0a9299272aa692992c437111bdd26e4d5505e6efc987		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135D5 11636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.