Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee089dc669c9cc51…

MALICIOUS

PDF

86.4 KB Created: 2021-04-02 19:18:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0d91faf274b918fd0759425b93af2b85 SHA-1: 2ec62a9460901c894d6b08b837c4c2b565640ae3 SHA-256: ee089dc669c9cc51687c501ceb09e37a7e9deeb8a84fe526f9db0db5fc374866
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing a deceptive URL that mimics a search result for 'Abortion laws in alabama 2019 pdf'. The embedded URL, 'https://pelibifir.ru/123?utm_term=abortion+laws+in+alabama+2019+pdf', is likely intended to trick the user into downloading a malicious payload disguised as a document. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=abortion+laws+in+alabama+2019+pdf
    • http://vizilirudigub.getenjoyment.net/sikefivujal.pdf
    • https://cdn.sqhk.co/lilapanorup/eidDPDd/moon_whales_poem_ted_hughes.pdf
    • https://cdn.sqhk.co/tirekidifole/9Qghrjc/bobuwaralitejor.pdf
    • https://cdn.sqhk.co/pedidagow/hgrBgea/7461512912.pdf
    • https://cdn.sqhk.co/tesadubozino/jiVbihA/lejupunatafigomowunigat.pdf
    • https://cdn.sqhk.co/tezasevimab/BjgPijs/16726856726.pdf
    • http://zabolojisag.getenjoyment.net/chick_fil_a_breakfast_menu_prices.pdf
    • https://cdn.sqhk.co/dedenijikal/gifXWid/cannon_balls_fire_blast_3d.pdf
    • http://bifozitixexidad.mygamesonline.org/bukhari_sharif_bangla_hadis.pdf
    • https://cdn.sqhk.co/lobitukojuro/ghFx1hw/87621100675.pdf
    • https://cdn.sqhk.co/zipirevofu/igQUhaP/rifajonirizomefijoridosuw.pdf
    • https://cdn.sqhk.co/ranemagesoga/29Ahaig/online_games_2d_shapes.pdf
    • https://cdn.sqhk.co/kevovevude/esHGeif/kobovuwi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/ninasivol/worthy_of_every_song_sheet_music.pdf
    • https://s3.amazonaws.com/xakapudakadu/nebuxilujadijid.pdf
    • http://duvodix.myartsonline.com/niriwojisuzojixepuf.pdf
    • https://s3.amazonaws.com/jejulurowev/atlantis_is_calling_song.pdf
    • https://s3.amazonaws.com/webipejonavuv/how_to_fix_a_stuck_stove_knob.pdf
    • https://s3.amazonaws.com/zarelusipofox/certainteed_fiberglass_insulation_spec_sheet.pdf
    • https://s3.amazonaws.com/nitajosasa/lopapesugudugonejo.pdf
    • https://s3.amazonaws.com/fipijife/react_google_maps_typescript_example.pdf
    • https://s3.amazonaws.com/pajukovuxetu/is_psychology_statistics_hard.pdf
    • https://s3.amazonaws.com/pusori/minn_kota_trolling_motor_repair.pdf
    • https://s3.amazonaws.com/legenapi/voxanakekag.pdf
    • https://s3.amazonaws.com/lijopavexanuse/difference_between_form_control_and_activex_control.pdf
    • http://wotidupodugi.myartsonline.com/84477388675.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113f9.bin
3623db1bedca4466d80ade7a1cd729474f59a59ffcc227f7d2f717d1ff859032		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113F9 5892 bytes
font_01_sfnt_off000127fb.bin
d6b953324a387aeff8cf09d42c2ac3b3350f319115d38cc1b85dbad0a156dee8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127FB 10408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.