Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2836f2e857ef70d…

MALICIOUS

PDF

79.2 KB Created: 2021-03-08 19:31:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93d4b77f533758c5f0918c06f46d8ca6 SHA-1: aa4f6cfbc8b056834538ca50f5e825b3625a2332 SHA-256: f2836f2e857ef70d2a4ed4eae7419faf94535901bae49fc6d4dc9ff9bd2eafb7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier. It contains an embedded URI pointing to a suspicious domain, which is likely used to host a phishing page or download a second-stage payload. The document body, though heavily obfuscated, suggests a technical topic, which is a common lure for phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/aws?utm_term=how+to+write+lambda+in+text+in+latex
    • https://cdn.sqhk.co/gimexigerub/3mf6V6w/tevatig.pdf
    • http://jinevul.mygamesonline.org/45689972441.pdf
    • https://cdn.sqhk.co/torazanopuni/b9gjiiL/human_resource_information_systems_hris_definition.pdf
    • https://cdn-cms.f-static.net/uploads/4387232/normal_6033b1d56c214.pdf
    • https://cdn.sqhk.co/satasevubu/bmifrI6/65434425319.pdf
    • https://cdn-cms.f-static.net/uploads/4447880/normal_601e14423c438.pdf
    • http://rejasikega.scienceontheweb.net/how_long_to_cancel_a_car_lease_after_signing.pdf
    • http://koxivesuvif.mypressonline.com/5105317738.pdf
    • https://cdn.sqhk.co/bikegola/gdQhehf/rigoxatejuwelure.pdf
    • https://cdn-cms.f-static.net/uploads/4382413/normal_600ef2d9974e5.pdf
    • http://gopidap.scienceontheweb.net/stock_market_lessons_for_beginners.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6e23afab-133c-42d0-a911-4320417c778c/futubalujefemujibetikepel.pdf
    • https://uploads.strikinglycdn.com/files/48f413a5-0e7f-4f18-828f-3131ec24e04b/rejuduret.pdf
    • https://uploads.strikinglycdn.com/files/ffffd69b-9062-4a7b-9c30-531666ff2359/50357393075.pdf
    • https://uploads.strikinglycdn.com/files/246052f3-1d42-412f-b429-64ee92fd0443/most_uncommon_last_names_in_australia.pdf
    • https://uploads.strikinglycdn.com/files/da55f3ba-bc69-434a-b603-3e38e2564317/what_causes_slow_processing_speed.pdf
    • https://uploads.strikinglycdn.com/files/3d9d17b1-ad61-4e16-aa70-9ba6150d4106/74131109375.pdf
    • https://uploads.strikinglycdn.com/files/ea9d6fc0-1e86-4d78-8036-246ecbd68e7d/mackie_control_universal_protocol.pdf
    • https://uploads.strikinglycdn.com/files/52e03c0b-849b-457a-8b56-0717d0ffec3a/fisher_paykel_dryer_reset_button.pdf
    • http://sujawokasafu.onlinewebshop.net/snes_game_genie_codes_super_mario_world.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1fb.bin
0a37fa429633dae6385b09bd52885e83548fd702ba43a1e42d2dfceeee18d19a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1FB 5056 bytes
font_01_sfnt_off0000f31c.bin
219b775cd03940775e4899d3e1a7fd41e4d9398d30e80e9c3b698a0e95fb0a2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF31C 17748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.