Malicious PDF — malware analysis report

Static analysis result for SHA-256 edfee0973cbccfbd…

MALICIOUS

PDF

157.0 KB Created: 2021-03-14 10:06:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5ec955f6c88a16747b2ff126002f33da SHA-1: 2297ccf35820363efbd376674373120aac85d1d0 SHA-256: edfee0973cbccfbda3091d6ae4572188dd123cbff026a07c437a9015451f752b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://xezojetit.ru/wix?keyword=contemporary+comedic+monologues+male', which is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, suggests a lure related to 'comedic monologues'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=contemporary+comedic+monologues+male
    • https://cdn-cms.f-static.net/uploads/4489045/normal_603fbc5f389a8.pdf
    • https://static.s123-cdn-static.com/uploads/4450870/normal_5fdea8499e49d.pdf
    • https://cdn-cms.f-static.net/uploads/4388421/normal_60173a750adca.pdf
    • https://static.s123-cdn-static.com/uploads/4393197/normal_5fed8e54c9346.pdf
    • https://cdn-cms.f-static.net/uploads/4470028/normal_601582d94ad2f.pdf
    • https://cdn-cms.f-static.net/uploads/4489041/normal_60372d5bb5881.pdf
    • https://cdn-cms.f-static.net/uploads/4453720/normal_5fd7893e79831.pdf
    • https://cdn-cms.f-static.net/uploads/4416810/normal_60386556af99b.pdf
    • https://static.s123-cdn-static.com/uploads/4407724/normal_60036206594d3.pdf
    • https://cdn-cms.f-static.net/uploads/4462974/normal_603f19607c8e3.pdf
    • https://cdn-cms.f-static.net/uploads/4410433/normal_6042edb87920e.pdf
    • https://static.s123-cdn-static.com/uploads/4387711/normal_5fecd50d407b8.pdf
    • https://cdn-cms.f-static.net/uploads/4380379/normal_6043356e78cae.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/kavalukato/91783758829.pdf
    • https://uploads.strikinglycdn.com/files/2d9a1991-5fbe-4dcf-a536-c559e782e261/59216612094.pdf
    • https://s3.amazonaws.com/sebunuzu/divagesafitonaga.pdf
    • https://uploads.strikinglycdn.com/files/e98db81c-1be4-4cfa-886f-defe5de4cd4f/43303044999.pdf
    • https://uploads.strikinglycdn.com/files/3e6e788b-7a06-4964-be40-f9956c912be6/42844223542.pdf
    • https://uploads.strikinglycdn.com/files/5398e00a-a4f5-406f-b117-b58465efa3a0/is_diablo_3_local_co_op.pdf
    • https://uploads.strikinglycdn.com/files/edc32c84-a46a-4770-a700-8f1685001384/5062351588.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00020a73.bin
071d169e193f39c84d31a931d5aa29a7a662badacc7805ee366e8d8a9f15bf02		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20A73 5400 bytes
font_01_sfnt_off00021cb9.bin
b076757d5dfae4a4c5b8329362c840719a670c8c7fdfb31b4fea7816530b3612		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21CB9 11452 bytes
font_02_sfnt_off000243c8.bin
d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x243C8 16060 bytes
font_03_sfnt_off00025860.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25860 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.