Malicious PDF — malware analysis report

Static analysis result for SHA-256 eafccbefdc96e9b1…

MALICIOUS

PDF

247.6 KB Created: 2021-03-31 11:39:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 24f937a9100406b46d3f1fcc1dc7bab4 SHA-1: 4a5ec18f68e988e921e643a5b048da03577ba4ff SHA-256: eafccbefdc96e9b1e4e24128490f366535c9e75ebf5cea9a3974ab1f246d37d7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'maypoin.ru', which is a strong indicator of a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests it is related to the 'Encyklika caritas in veritate pdf' and was generated by wkhtmltopdf, a common tool for creating PDFs from web content, potentially to disguise malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9881

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=encyklika+caritas+in+veritate+pdf
    • https://lixazasowab.weebly.com/uploads/1/3/4/5/134588429/3a79c7c05c.pdf
    • https://litusavetedi.weebly.com/uploads/1/3/4/4/134445261/giwonuvonavepok.pdf
    • https://wofalexo.weebly.com/uploads/1/3/4/6/134697980/semurekibug.pdf
    • https://sivipamekan.weebly.com/uploads/1/3/2/6/132682587/236923.pdf
    • https://togoxijagujeg.weebly.com/uploads/1/3/0/7/130775712/pododetozebile-geginelusewebom.pdf
    • https://cdn.sqhk.co/vawupemowa/jajhelF/xiserarolemuwapivixap.pdf
    • https://tubenuluni.weebly.com/uploads/1/3/1/4/131437864/40d34d5ff6.pdf
    • http://tomogorman.com/ejemplo_de_suma_de_vectoreswv74n.pdf
    • https://gikigafe.weebly.com/uploads/1/3/4/4/134440869/sozimubo.pdf
    • https://cdn.sqhk.co/xupodafib/whfKGjb/70_80_90_rock_songs_list.pdf
    • https://wovitinukid.weebly.com/uploads/1/3/4/3/134372120/2bc9de114f4573.pdf
    • http://naturebiolog.fun/47207185107v50z2.pdf
    • https://fuketuxe.weebly.com/uploads/1/3/4/4/134495293/wepexakulolizo-debavo-mamuvo-losarijixereza.pdf
    • http://dashcamtopbest.com/9514392658il8ku.pdf
    • https://zozolesib.weebly.com/uploads/1/3/4/6/134631165/a3f75f84b85.pdf
    • https://bebojeraje.weebly.com/uploads/1/3/5/3/135302211/2b8f48.pdf
    • http://shopmzm.site/tojibosuparumakuwarebuqpbo.pdf
    • https://cdn.sqhk.co/susiwozobo/jsXr0IK/3081829449.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_8f1599093f2945e29d64e0847bb27141.pdf?index=true
    • https://1a447ccf-a6a5-490c-ad31-399ae8169532.filesusr.com/ugd/cf5184_818bf06630e044c89c011161cb9e4841.pdf?index=true
    • https://709e7e89-b264-4d73-b757-064736ed86f1.filesusr.com/ugd/f523c3_4d4d1ed8002d4bb5885f605d1d913366.pdf?index=true
    • https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_c8049b06ce194e42a2312baa4ad6f9ff.pdf?index=true
    • https://e6f9d1db-9bad-45ba-a188-0e8e378e8087.filesusr.com/ugd/99b222_3fae37833ef448b4a0ccef61e34eba50.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000392aa.bin
781034cc18954baa7463f9ec1009593a21258e3e78572d9d86df0b1cb9d7fa35		 pdf-font-stream PDF embedded font (sfnt) at offset 0x392AA 5332 bytes
font_01_sfnt_off0003a4f7.bin
568c8f1a783f085f5f0ab250d8365aeed3e2c82dd15ef2931cbb4bfec9d097ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A4F7 13204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.