Malicious PDF — malware analysis report

Static analysis result for SHA-256 f105d1abcf949c05…

MALICIOUS

PDF

195.8 KB Created: 2021-03-29 20:40:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 0f90d444a3ea280294bcee22cc369f56 SHA-1: ce08c765ae6f609df341270adea8bf1d179b56ef SHA-256: f105d1abcf949c050696de501e5469f3b33817aabd314705ca229a743c9968ab
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a malicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though partially corrupted, suggests a lure related to a religious query, aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9933

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=quran+is+the+holy+book+of+which+religion PDF link annotation
    • https://cdn.sqhk.co/kemomonil/57phhC0/happy_tree_friends_lumpy_plush.pdfIn PDF document text
    • https://diwijavel.weebly.com/uploads/1/3/4/6/134691177/folegavor_keredipa_kuvubukud.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465144/normal_5fe5bc1341ded.pdfIn PDF document text
    • https://besuxape.weebly.com/uploads/1/3/4/3/134374749/wujaxujogukutoj.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417983/normal_5ff5472c5c137.pdfIn PDF document text
    • https://tonawonigavima.weebly.com/uploads/1/3/5/3/135345065/lukebu-nojowa-posimiromog-pigoba.pdfIn PDF document text
    • https://varusotefus.weebly.com/uploads/1/3/1/3/131398431/ad055cd5faf0ac.pdfIn PDF document text
    • https://cdn.sqhk.co/vibisidumes/oggcWge/emojination_2_answers_level_6.pdfIn PDF document text
    • https://cdn.sqhk.co/jipodipotaj/ghfiihh/online_social_media_marketing_courses_with_certificates.pdfIn PDF document text
    • https://cdn.sqhk.co/dubeminap/ihdVjeX/togetetunamababelozaketa.pdfIn PDF document text
    • https://cdn.sqhk.co/xasexuwosul/eihifit/68932426003.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/popilo/how_to_properly_apply_hair_color.pdfIn PDF document text
    • https://s3.amazonaws.com/dazemi/6964401896.pdfIn PDF document text
    • https://s3.amazonaws.com/zonebon/iras_gst_general_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/gifiz/50647462056.pdfIn PDF document text
    • https://9c43cb74-45e3-47de-9527-fda2e8336169.filesusr.com/ugd/af0aa9_c8af05e28b6b4b499aef8e2719fdb22c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sefepugolupalax/ifrs_15_disclosure_template.pdfIn PDF document text
    • https://f608bf75-187c-4b28-9621-af925c05c2b6.filesusr.com/ugd/05e3ad_430f5a58db5c4299967e9ccdd0c3280f.pdf?index=trueIn PDF document text
    • https://6c8ebe11-725c-420b-823a-68bc39d02ad2.filesusr.com/ugd/3e87bf_9ac725413a1d48f4b685b13d533299cb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jamuluvuvava/28116206079.pdfIn PDF document text
    • https://70010cfe-69b1-4fe9-a336-bdfe2418dc1e.filesusr.com/ugd/f1d680_1e9c06702a10441f8c9099bf2c485a03.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/muwemivumazulax/danewoji.pdfIn PDF document text
    • https://s3.amazonaws.com/gotenukevepunin/98072951049.pdfIn PDF document text
    • https://s3.amazonaws.com/naxozelozude/fluke_t5-600_for_sale.pdfIn PDF document text
    • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_de1a438b684748f7a65a618746b8ae35.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0002c1dc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2C1DC 25000 bytes
SHA-256: 6c82c6bfc57a129717fb97fb768e8ede6f7ca4f792e90befcac7256872d6efba
font_00_sfnt_off00027bec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27BEC 5604 bytes
SHA-256: 16d0f29152843a46d95d536dedfbe72c0e31e369ebf6e5b6bd4fc9e92cc4d1d9
font_01_sfnt_off00028f13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28F13 17364 bytes
SHA-256: 489128345693721b29579a2ece1a3d98acddaf3f4deed5bd71e0a7b1c79db246
font_03_sfnt_off0002efb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EFB8 6356 bytes
SHA-256: 45874e528f0f0e61c04ba81864773c5174e3d059c9f52e071ede1bc37dcdbbd1

Open this report in the interactive analyzer, or submit your own file for analysis.