Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9fa8377ff655a23…

MALICIOUS

PDF

92.9 KB Created: 2021-04-16 08:37:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7f347179d0f612afc3e7ef5b1234882e SHA-1: 21ca9583d56b635b48239b81f95276a64a32d5dd SHA-256: e9fa8377ff655a231687d1e6d3d3b5476500a4a477e716e37830165d30427039
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an embedded URI pointing to 'xezojetit.ru' suggests an attempt to redirect the user to a potentially harmful site. While no scripts were explicitly extracted, the PDF structure and embedded URI are strong indicators of a phishing or malware distribution attempt, aligning with the Spearphishing Attachment technique.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=the+heir+of+memories+location
    • http://xufededubumavif.scienceontheweb.net/16591527176.pdf
    • https://static.s123-cdn-static.com/uploads/4443578/normal_5fcd7ea99128b.pdf
    • https://cdn-cms.f-static.net/uploads/4487631/normal_6043b2386ec98.pdf
    • https://cdn-cms.f-static.net/uploads/4470211/normal_604dcf2fea3ae.pdf
    • http://sesesuruko.mypressonline.com/how_to_apply_adore_semi_permanent_color.pdf
    • http://pararapameso.getenjoyment.net/dieta_cetogenica_menu.pdf
    • http://poruzotosiku.getenjoyment.net/54995633254.pdf
    • http://vimobewawulipiz.mypressonline.com/autodesk_maya_2020_a_comprehensive_guide_download.pdf
    • http://xamojopilupivo.scienceontheweb.net/chemistry_compound_formula.pdf
    • http://jidameke.mypressonline.com/spelling_rules_ing_exercises.pdf
    • http://kedugobepuged.mywebcommunity.org/79292039483.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/14cc7c0c-bb36-4b9e-bb4a-514e3abab6d6/microsoft_excel_training_course_near_me.pdf
    • https://s3.amazonaws.com/bagisi/99741458103.pdf
    • https://s3.amazonaws.com/nilafafakem/lojureponatajid.pdf
    • http://velelakolifuvu.onlinewebshop.net/pdf_file_online_edit_free.pdf
    • https://s3.amazonaws.com/vezumobigodub/migaz.pdf
    • https://s3.amazonaws.com/xirixepo/real_survival_battle_royale_squad_mobile_apk.pdf
    • https://uploads.strikinglycdn.com/files/6a7b421a-5857-4130-a570-83bd1ad5454e/healthcare_operations_manager_jobs_nyc.pdf
    • https://s3.amazonaws.com/wofaxil/android_auto_2019_update.pdf
    • https://s3.amazonaws.com/lovomijelun/media_player_program_in_android_studio.pdf
    • https://s3.amazonaws.com/lososimap/14537350989.pdf
    • https://s3.amazonaws.com/zemigiduwagafu/asbestos_sheet_removal_suffolk.pdf
    • https://s3.amazonaws.com/xidulumexi/60377633296.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001208c.bin
b4cc304fe3b4225d24f4f33246a9620577e87ec31acb26db81e32e6482b5e3f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1208C 4860 bytes
font_01_sfnt_off000130da.bin
c7e3a076cf28d5c43af26f9ccc9023f85487bffa2279768b53dc54813955208f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130DA 11732 bytes
font_02_sfnt_off00015850.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15850 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.