Malicious PDF — malware analysis report

Static analysis result for SHA-256 f236fa9d538f8d1b…

MALICIOUS

PDF

80.7 KB Created: 2021-05-22 13:41:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 24937273d7abd5cab4dd26013b377001 SHA-1: a7f4c3bbbbf07c5a931037ce5807fee64937df80 SHA-256: f236fa9d538f8d1b4adf27b12995f508615c2e56f99e1c4b93854cfa1bf77e90
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'xezojetit.ru' was extracted, suggesting the document's purpose is to redirect the user to a potentially harmful site. No scripts were extracted, but the presence of an embedded malicious URL is sufficient evidence for a phishing or malware distribution attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=%25C4%2591%25C3%25A1nh+gi%25C3%25A1+%25C4%2591%25E1%25BA%25A7u+karaoke+hanet+playx+one PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369162/normal_5fe651936a619.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464871/normal_604690ba8d357.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383922/normal_603279482ff4a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382976/normal_603d2b264dc85.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405650/normal_5fdd8aba0e71d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e312428-b4ca-4a5b-8214-c36cee508922/joke_book_for_5_year_old_boy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88fae93d-ac57-40b4-a6bc-0ee89884348a/jaletejevanigutape.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bab0eed4-4f1f-44c8-bb9a-282555406eb7/is_it_worth_buying_a_roku_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4ed1ace-d097-4c67-878f-6c15f9ff97ca/dominos_pizza_recipe_copycat.pdfIn PDF document text
    • https://s3.amazonaws.com/sesijesule/carteles_informativos_para_imprimir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/355e6373-2679-41d5-b56f-6c7060f3aae8/80474969611.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcf99f60-2e52-432a-a7cc-99be9fe654e4/united_states_v_dougherty_case_brief.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0f8cb67f-7348-40f3-b3da-fb5aae11ff5f/cuanto_equivale_un_metro_cubico_en_cm.pdfIn PDF document text
    • https://s3.amazonaws.com/xanunafojuloki/tewexafoleluge.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/155c7fcc-b46f-4109-95b5-8e61c20c706a/bilina.pdfIn PDF document text
    • https://s3.amazonaws.com/xopugup/fadorabibitel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/012364b9-7ee4-44fe-a602-c6c7cd6f4ef8/how_to_program_hampton_bay_low_voltage_transformer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38a30c65-37b0-4944-9cbe-750bdd109ebb/how_to_say_lemongrass_in_spanish.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/how_to_make_video_file_smaller_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/vovuzize/95625013775.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfe521c7-d655-4c90-9992-250a61966dcc/the_wine_bible_latest_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65100efc-1747-40e2-a73b-9a66361208ca/fezibibasofadawuduzise.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC99 5808 bytes
SHA-256: c351f773bedcf77b0e5cc829a2cdee1b6bc4125e23f1447096a66a1060327c14
font_01_sfnt_off0000ff49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF49 24384 bytes
SHA-256: 0a2fb331e078fc2efe443dd74485c9e9daba8b3bff59f4ff31fa9f17264b625a

Open this report in the interactive analyzer, or submit your own file for analysis.