Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebaee2b46e953b59…

MALICIOUS

PDF

76.8 KB Created: 2021-04-09 12:47:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 71d2c65bdf5e522203e3b4c145dc64ef SHA-1: 2eb3afc0e88022674c12abe5255c2185a2f755b0 SHA-256: ebaee2b46e953b59fdc04ff14e2508aa5489436951dc988f8b733b71ac888795
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, suggesting it's used to redirect users to a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=cuisinart+dgb-800+burr+grind+%2526+brew+12-cup+coffeemaker
    • http://about-central.com/dazevalezonotq1hqo.pdf
    • https://cdn.sqhk.co/pumevigatare/chiu4NL/crowd_sounds_nfl_2020.pdf
    • https://cdn.sqhk.co/jujuziwe/ajb7Xjb/glitch_effect_photoshop_gif.pdf
    • http://zoguponuwuxoli.medianewsonline.com/35243536577.pdf
    • https://cdn.sqhk.co/patemugimej/Xhjchjn/twisted_wonderland_leona_gallery.pdf
    • https://cdn.sqhk.co/libodinidep/jaIhdhd/britney_spears_american_dream_hack_download.pdf
    • http://foodguideblog.com/wuporejuxotiruwefefefglzwb.pdf
    • http://blognews.top/pan_card_offline_form_49a54yyb.pdf
    • http://natbeach.space/vewimiwinaiws9c.pdf
    • https://cdn.sqhk.co/vakujediraw/Igd2heZ/gazexelafolam.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/488e168b-f51f-4c1c-b6f6-2443337daad5/womavivuvexumarazonuli.pdf
    • https://uploads.strikinglycdn.com/files/e49404fc-6dad-48e7-ab73-bad2c10ad1e5/97910247123.pdf
    • http://sadabodavezuzi.epizy.com/finger_math_worksheets.pdf
    • http://likamufibunefar.epizy.com/ragal.pdf
    • https://uploads.strikinglycdn.com/files/46461fd7-1a6b-4977-bc34-5c66ad4c5b42/tilanajune.pdf
    • http://kedisijusa.onlinewebshop.net/87297051200.pdf
    • https://uploads.strikinglycdn.com/files/5ef6fc23-1c1c-4473-9321-b02646334cc3/what_were_three_goals_of_the_radical_republicans_during_reconstruction.pdf
    • http://laxuzoto.onlinewebshop.net/101_algebra_problems.pdf
    • https://uploads.strikinglycdn.com/files/aa324a29-c9b9-4bdb-bd1f-f772e46c81f8/74000825655.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee48.bin
ddcd8901bbc7110683e8fecab69d5cfa18b67c51a409baf7d3d4d1f6404dd9ec
pdf-font-stream PDF embedded font (sfnt) at offset 0xEE48 5376 bytes
font_01_sfnt_off00010094.bin
ad490377aa829d9aa97c95d885a0357beb51c305fa3bea5951b1ec34530ba855
pdf-font-stream PDF embedded font (sfnt) at offset 0x10094 10520 bytes