Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9df30cbad72c6aa…

MALICIOUS

PDF

87.3 KB Created: 2021-03-20 16:29:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0b836c27144fe5f305f24122828fb725 SHA-1: 7acd102224bb138e972c0f6e6b4e86df8e79dc7d SHA-256: e9df30cbad72c6aa269b7bc940fe350bc01fe4a719e3df720a786698b631b25e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URL pointing to a suspicious domain, which is also flagged by heuristics. The PDF's metadata and body text, though partially corrupted, suggest an attempt to disguise the malicious intent with seemingly innocuous content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=ffx+shinryu+guide
    • https://cdn-cms.f-static.net/uploads/4370076/normal_6024a369dabef.pdf
    • https://cdn-cms.f-static.net/uploads/4474231/normal_6055b732cc95b.pdf
    • https://cdn-cms.f-static.net/uploads/4502245/normal_602d75f04ae64.pdf
    • http://kogiwonewaveg.iblogger.org/38455723493.pdf
    • https://cdn-cms.f-static.net/uploads/4372983/normal_600ead2c69965.pdf
    • https://static.s123-cdn-static.com/uploads/4503767/normal_5ffc88f8a38f9.pdf
    • https://cdn-cms.f-static.net/uploads/4379236/normal_60369e6d63cdd.pdf
    • http://papotupeti.iblogger.org/10155442380.pdf
    • https://cdn-cms.f-static.net/uploads/4481397/normal_601b8debc0b0d.pdf
    • http://xigesoti.iblogger.org/where_is_the_engine_number_on_a_ford_focus.pdf
    • https://cdn-cms.f-static.net/uploads/4414339/normal_601a2beb82ebf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zukowuneze.rf.gd/vampire_diaries_season_3_quiz_sporcle.pdf
    • http://pimuxexud.epizy.com/online_application_form_for_ibps_po_2019.pdf
    • https://s3.amazonaws.com/garorowa/hip_hop_albums_free_online.pdf
    • https://s3.amazonaws.com/nilititonawafim/43883796.pdf
    • https://s3.amazonaws.com/sedowedi/regukovuxajanu.pdf
    • https://s3.amazonaws.com/vebogotexaf/checkbox_button_android_java.pdf
    • https://s3.amazonaws.com/patotale/71104031823.pdf
    • http://kotasogova.rf.gd/jekixamepevizofari.pdf
    • http://jomusosufetobox.rf.gd/game_maker_studio_1.4_license_key_free.pdf
    • http://nogojituwizax.epizy.com/diageo_plc_annual_report_2019.pdf
    • http://vafowoloxesimam.rf.gd/42580890878.pdf
    • http://bapomel.epizy.com/google_picture_search_app_android.pdf
    • https://s3.amazonaws.com/nisiwanolom/wivodujolimaborub.pdf
    • https://s3.amazonaws.com/wupixufekijax/la_iliada_canto_22_resumen_y_analisis.pdf
    • https://s3.amazonaws.com/wewuxuviwar/synonym_for_additional_information.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f347.bin
29288642c8d9a7fff48daa733c6ae225e1ff1e7d6e5a6f9d45611f4670ccb018		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF347 3700 bytes
font_01_sfnt_off00010055.bin
81466e2d8f308c2b86afe60bad5b116752d82cbb885ef270382c081afdaf4a67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10055 5052 bytes
font_02_sfnt_off00011198.bin
4fb0889781c101cfa97473dec0fae4a80d2cb055a33048f737cff3f57be3ea73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11198 11680 bytes
font_03_sfnt_off000138d8.bin
e9fe716c2abc985b12a899a49d5539e4e8be1b56d50c083b30290d85a2a7c848		 pdf-font-stream PDF embedded font (sfnt) at offset 0x138D8 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.