Malicious PDF — malware analysis report

Static analysis result for SHA-256 e90d71aa070b37c2…

MALICIOUS

PDF

77.3 KB Created: 2021-04-01 09:06:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 328735e1ab90934c3cc752306b73f230 SHA-1: e70f8e08d6fd99d9b6dc9b15ddf5ecc787400514 SHA-256: e90d71aa070b37c2877cc2f58dbe2d2adb949581db2ab4bc00b90332a0ea19f6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that points to a suspicious domain, disguised with a keyword related to sheet music. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or to serve a second-stage payload. No scripts were extracted, but the PDF structure and embedded URI are sufficient indicators of a malicious lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=after+you+ve+gone+sheet+music+pdf PDF link annotation
    • http://hotel-engels.ru/rigajiverh838d.pdfIn PDF document text
    • http://lyudi23.ru/iron_man_hand_foam_templatesmwgkl.pdfIn PDF document text
    • http://luminar4-download.xyz/bmw_nav_6_car_kitaptbp.pdfIn PDF document text
    • http://rokonagusedat.22web.org/bullying_in_schools.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448744/normal_601ff39ce2f08.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501965/normal_601eda6be62ab.pdfIn PDF document text
    • http://cardioactiveitalia.site/fukogegobarefenuvisoghof.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414500/normal_6018c4feba363.pdfIn PDF document text
    • http://italy-small.space/zevitomufonaxarqjjdm.pdfIn PDF document text
    • http://kelirajisob.66ghz.com/birla_mutual_fund_sip_form.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389370/normal_5fdafd10e2dd8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/leributafa/34791416600.pdfIn PDF document text
    • http://pinamagowejut.epizy.com/australia_colposcopy_guidelines.pdfIn PDF document text
    • http://guwajip.epizy.com/gender_is_a_social_construct.pdfIn PDF document text
    • https://s3.amazonaws.com/mafavuzenoliki/assassin_s_creed_revelations_apk_free.pdfIn PDF document text
    • https://s3.amazonaws.com/levumoduf/62524054940.pdfIn PDF document text
    • https://s3.amazonaws.com/boxalewijim/40842577279.pdfIn PDF document text
    • https://s3.amazonaws.com/jivamubug/minn_kota_ulterra_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/sezewu/70826801438.pdfIn PDF document text
    • https://s3.amazonaws.com/gumagabu/episcopal_baptismal_certificate.pdfIn PDF document text
    • https://s3.amazonaws.com/vufupu/xumebixavevoferoralogi.pdfIn PDF document text
    • http://fivupibutori.rf.gd/delerazurojodinobotat.pdfIn PDF document text
    • https://s3.amazonaws.com/warapagefasovi/descriptive_writing_structure.pdfIn PDF document text
    • https://s3.amazonaws.com/satedafadusizo/49347465769.pdfIn PDF document text
    • https://s3.amazonaws.com/winumigutam/how_to_download_gta_5_on_xbox_one_for_free.pdfIn PDF document text
    • https://s3.amazonaws.com/xonaxevetaf/android_racing_games_with_controller_support.pdfIn PDF document text
    • https://s3.amazonaws.com/penale/answered_a_judge_crossword_puzzle_clue.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED1A 5476 bytes
SHA-256: b695b63733ff0a0ff336407bbdfecc81bc2aed481a2f22b14a9b0611ea32315b
font_01_sfnt_off0000ffaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFAF 11588 bytes
SHA-256: 3e125afa70f1cbf264681b880b01c11ddc343c074a2137dedf9ee19eb056d4d4

Open this report in the interactive analyzer, or submit your own file for analysis.