Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef25f1c157331547…

MALICIOUS

PDF

77.4 KB Created: 2021-06-12 12:18:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 86d05e923c2a2c4f7c0b4e5eaa0de72d SHA-1: a22808593195cbc11e61f67a79556664e2920927 SHA-256: ef25f1c1573315474a09d87bea1cdfaf18d5948e15a70b1f669bd2cf97a768c0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://cructi.ru/pbw?utm_term=neutral+positive+and+negative+connotations', which is likely the primary malicious payload delivery mechanism. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the external URI strongly suggests a phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/pbw?utm_term=neutral+positive+and+negative+connotations
    • https://static.s123-cdn-static.com/uploads/4480735/normal_5fefe47e18ae8.pdf
    • https://cdn-cms.f-static.net/uploads/4385012/normal_5fd958ccc15a8.pdf
    • https://cdn-cms.f-static.net/uploads/4488330/normal_602aed1e91d9f.pdf
    • https://static.s123-cdn-static.com/uploads/4370317/normal_5ff7d08aa7faf.pdf
    • https://static.s123-cdn-static-d.com/uploads/4478951/normal_60aff8689e31d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://puzavofan.pbworks.com/w/file/fetch/144549093/madawojagoxegevufakatila.pdf
    • http://fijinatuzut.pbworks.com/f/nomumukodibeli.pdf
    • http://vadibun.pbworks.com/w/file/fetch/144930858/prime_minister_youth_loan_online_apply.pdf
    • http://niraxaba.pbworks.com/f/cheat_sheet_ubuntu.pdf
    • http://dipazuwawex.pbworks.com/f/how_to_play_a_blues_scale_on_piano.pdf
    • http://nidibewuzi.pbworks.com/f/dangling_modifier_exercises_with_answers.pdf
    • http://xofitesu.pbworks.com/f/92871592491.pdf
    • https://uploads.strikinglycdn.com/files/68630585-20a2-464a-9307-9c3d10f10c2e/nukavex.pdf
    • https://uploads.strikinglycdn.com/files/c611f1a7-2f9c-4022-86d4-56ee09eb4bf4/59888176797.pdf
    • https://uploads.strikinglycdn.com/files/036d8044-3ede-40ca-99c4-c7cfb5151837/62535877706.pdf
    • http://ridelox.pbworks.com/f/how_to_insert_endnote_in_google_docs.pdf
    • http://junerew.pbworks.com/w/file/fetch/144503055/what_is_the_catholic_nicene_creed.pdf
    • https://uploads.strikinglycdn.com/files/9bdb7071-0b47-4b5d-b73f-dd1043601413/minecraft_pe_13.0_free_download_1.1.5.1.pdf
    • https://uploads.strikinglycdn.com/files/555f6bf7-29ef-423b-80b4-a9918fb303cb/basime.pdf
    • https://uploads.strikinglycdn.com/files/6ac0b90f-ed4d-4e0e-9f67-770fd62f7512/lekipoziriterawelu.pdf
    • https://uploads.strikinglycdn.com/files/394396a5-5677-4298-8f69-faa2547886c8/90640787910.pdf
    • https://uploads.strikinglycdn.com/files/514b33fd-b0b1-4b62-be49-6c338de9c67a/9883179750.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f131.bin
211f62876e121bec115fc2d3458c9349170b6e2975c5ffa03ceacbff4a7cb950		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF131 5268 bytes
font_01_sfnt_off00010334.bin
0fbff4bb0b304851c4d9d0f36e62608ee01d2c4c918e0c6545a3bc614bf8e987		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10334 10936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.