Malicious PDF — malware analysis report

Static analysis result for SHA-256 eae8b50f72dac070…

MALICIOUS

PDF

65.4 KB Created: 2021-03-15 10:15:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b713559f9309f18efc9502aa5f3dc756 SHA-1: d6e1c18222a79cbf39b346c1f50f80f3f08b3de1 SHA-256: eae8b50f72dac0708b4bfade86cc516198c27781877333c783804c583679b6bd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains a URL leading to a malicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though truncated, suggests a lure related to a 'bug report'. The presence of embedded URLs and the ML classifier's high confidence indicate a phishing attempt designed to redirect users to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=cheritz+mystic+messenger+bug+report
    • https://cdn-cms.f-static.net/uploads/4377400/normal_60412dc8b4c3f.pdf
    • https://cdn-cms.f-static.net/uploads/4413587/normal_600c8b0a269f0.pdf
    • https://static.s123-cdn-static.com/uploads/4386824/normal_5ff507edcaad6.pdf
    • https://cdn.sqhk.co/nivunufozub/ZJ7hcic/figixawinevefonenalovet.pdf
    • https://static.s123-cdn-static.com/uploads/4406481/normal_5ff10987c1eef.pdf
    • http://vowufijetapiko.sportsontheweb.net/everything_explained_for_the_professional_pilot.pdf
    • http://xunarepozufuz.mygamesonline.org/body_movement_worksheet.pdf
    • http://zonokiwuwagupu.getenjoyment.net/mapa_biarritz.pdf
    • https://cdn.sqhk.co/tivinarafuvu/aChhhbJ/ice_fire_wolf_wallpaper_download.pdf
    • http://kefijor.mygamesonline.org/livavizijuwapewalugaruke.pdf
    • https://kerawidirara.weebly.com/uploads/1/3/4/7/134746453/8690131.pdf
    • https://wikafifej.weebly.com/uploads/1/3/2/8/132815388/be5a26cc1894a.pdf
    • https://galixasuja.weebly.com/uploads/1/3/4/5/134518214/1115137.pdf
    • https://static.s123-cdn-static.com/uploads/4451376/normal_5ffb50cdbaef4.pdf
    • https://cdn-cms.f-static.net/uploads/4417325/normal_6009efbcf2a86.pdf
    • http://ziwewixowele.sportsontheweb.net/junie_b_jones_read_aloud_book_14.pdf
    • https://cdn-cms.f-static.net/uploads/4462345/normal_5fe9b96ceae92.pdf
    • http://wedevaz.sportsontheweb.net/present_perfect_past_simple_lesson_plan.pdf
    • http://zovolexune.sportsontheweb.net/how_to_adjust_ryobi_blower_carburetor.pdf
    • https://cdn.sqhk.co/wibafozadil/hgfjfQI/business_name_generator_domain_checker.pdf
    • http://fuvesozufinefi.medianewsonline.com/68988198273.pdf
    • https://fomoxizukewoviw.weebly.com/uploads/1/3/0/7/130739072/f0b8766afeec7a7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c456.bin
b8db59fcc481f7689f40747a01cfba0d598d98b410437cf19245cf716b3b27f4
pdf-font-stream PDF embedded font (sfnt) at offset 0xC456 5300 bytes
font_01_sfnt_off0000d645.bin
0073a60f25a6fce8798e2484670f3409a9e089bc14b6379cc69c71bce7a52327
pdf-font-stream PDF embedded font (sfnt) at offset 0xD645 10128 bytes