Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea38ae4376e6fb7e…

MALICIOUS

PDF

80.3 KB Created: 2021-03-13 21:07:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 08fd1da88b014f3516aa6cc7fa22e169 SHA-1: 2cd54d6c4e62e5b103cb6ed44cee5b25b28d1806 SHA-256: ea38ae4376e6fb7e714b2ed67c820b868ec244f357ae80b55d7fd0d7919dcabf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains an embedded URI pointing to a suspicious domain, 'leonvi.ru', which is likely used to host malicious content or phishing pages. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external URLs and the overall detection profile strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=asbabun+nuzul+pdf+indonesia
    • http://xplaintome.ru/what_are_the_franciscan_valuestawbf.pdf
    • http://yourlivehelp.com/bowflex_xtreme_se_owners_manualbnd0t.pdf
    • http://toolsbestpricemicrometer.site/hurst_review_book_answersfiprw.pdf
    • http://vivudanu.scienceontheweb.net/icse_maths_book_for_class_10_download.pdf
    • http://jekenufakewe.mypressonline.com/how_to_hard_reset_iphone_5_forgot_password.pdf
    • http://leziwazedo.mypressonline.com/apc_smart_ups_1000_not_turning_on.pdf
    • http://omoikiri.info/197604801035qllt.pdf
    • http://tosefabebiribow.scienceontheweb.net/kobalt_7_inch_tile_saw_reviews.pdf
    • https://cdn.sqhk.co/vukupamita/HODFjg3/83434056320.pdf
    • http://rowefuzoj.mygamesonline.org/carmilla_free_download.pdf
    • http://kubosikavudux.mygamesonline.org/91460711996.pdf
    • http://pedagodogiko.getenjoyment.net/how_to_speak_mandalorian.pdf
    • https://cdn.sqhk.co/fuluzezufe/1igdkLN/36997957806.pdf
    • http://natiral.space/price_of_pomeranianxrdha.pdf
    • http://bikejesoxatelo.mygamesonline.org/kagudedejifuvoziz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xaliwalufoguni/lagu_afternight_project_for_you.pdf
    • https://uploads.strikinglycdn.com/files/62333acf-1909-486b-b352-68cdfe2b7143/boss_ns-2_isp_decimator.pdf
    • https://uploads.strikinglycdn.com/files/871d07c7-ca0a-4e2e-b93b-92c902569fc7/black_no_more_chapter_7_summary.pdf
    • https://uploads.strikinglycdn.com/files/2023aa3c-9b3a-4152-a097-d66e16b20c93/vepawafijan.pdf
    • https://s3.amazonaws.com/jozetej/cengage_chemistry.pdf
    • https://s3.amazonaws.com/dikobepibelun/alimentacin_complementaria_minsa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2e8.bin
8da0b503a54eba9768efbd46f50e9b6f9728c4b9a26748ed0dc5ac483f5ea01c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2E8 5120 bytes
font_01_sfnt_off0000f46e.bin
1bba9f17cf8ee6380cf0a9cfc8406d8bd688ef7410b5aa42824fca9ed0c5bcc3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF46E 11820 bytes
font_02_sfnt_off00011b53.bin
cd75105a6438e4b9e08ea898f201de2336868cc503dad130454fda152fee7382		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B53 16956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.