Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0e689eae4aa4d88…

MALICIOUS

PDF

90.1 KB Created: 2021-04-07 15:29:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c191880604622723d8c25d1a65be43f6 SHA-1: 56b5d1d4095f43f1524ad0923b57dc2224a65e9f SHA-256: f0e689eae4aa4d88b281510c4b437ce116f4b41005a5527643ae77db962d0689
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, masquerading as a search result. This indicates a phishing or social engineering attempt to direct the user to a malicious site. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+draw+a+dragon+easy+cute
    • https://cdn-cms.f-static.net/uploads/4484370/normal_6030cc1a4e409.pdf
    • https://cdn-cms.f-static.net/uploads/4465394/normal_602adf97edc26.pdf
    • https://cdn-cms.f-static.net/uploads/4454965/normal_5fe7a312b6fca.pdf
    • http://bibajif.22web.org/banitonusosewezix.pdf
    • http://worameruvejaka.mywebcommunity.org/how_to_use_dynamite_prophet_sport_lipo_charger.pdf
    • http://xenalebosob.scienceontheweb.net/67609549052.pdf
    • http://witikotuxigere.scienceontheweb.net/lefapugiz.pdf
    • http://nageramuvepom.mywebcommunity.org/67490092275.pdf
    • http://kazexezawulozij.mypressonline.com/kubisavoge.pdf
    • http://kegumexiwekot.22web.org/40842799759.pdf
    • https://cdn-cms.f-static.net/uploads/4467043/normal_5fd9c99f7dc8e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://1c985592-4fe2-425a-b8d2-7dc24782370c.filesusr.com/ugd/a13bc2_f158eb49bddd4df6a1adf1f5385165cb.pdf?index=true
    • http://pibonev.rf.gd/adjective_and_noun_worksheets.pdf
    • https://s3.amazonaws.com/ruzumeb/ms_word_2007_download_for_pc_windows_7_64_bit_filehippo.pdf
    • https://s3.amazonaws.com/jemazejodep/7528649644.pdf
    • https://s3.amazonaws.com/wovugi/bootstrap_login_form_design_responsive.pdf
    • http://xoxalufuropa.epizy.com/tabaquismo_alcoholismo_y_drogadiccion.pdf
    • http://vawofirulev.myartsonline.com/mcdonald_s_south_africa_menu.pdf
    • https://s3.amazonaws.com/xoxaneral/merosojawinuzepemake.pdf
    • https://9a86171b-24d8-4f43-8717-687e75280c8f.filesusr.com/ugd/6234e8_a82835cd091b4fe2a085589153747f46.pdf?index=true
    • https://s3.amazonaws.com/xupovobejanam/audio_converter_for_apple_ipod_free.pdf
    • http://tosabukevosubar.myartsonline.com/bedogoxuvasejowiziwabisu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000114e8.bin
4b63f4b698d270c48e7320fad28df6bcfdc600bbc245d50e447a4cff13381e7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114E8 5064 bytes
font_01_sfnt_off0001263d.bin
15e455a8f58076203314db925e2c02bcefce6d71fb6659174b57974a924e9470		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1263D 11460 bytes
font_02_sfnt_off00014d29.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14D29 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.