Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2b8b36371262399…

MALICIOUS

PDF

162.4 KB Created: 2021-03-31 22:08:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97f0b5eef8a01df257887fa2f8a0ae0b SHA-1: dde1abc76093201635e2ffb5642e9d35e5aa7efe SHA-256: f2b8b36371262399d12eb852dd186eda00846b46e540140694371038ecdd5c2c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URLs, particularly the one pointing to 'leonvi.ru', suggest a phishing attempt to trick users into visiting a compromised or malicious site. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are commonly used to host phishing lures or redirect to exploit kits.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=base64+to+pdf+node+js
    • https://cdn.sqhk.co/verexoleki/hdfjjtN/pancake_art_griddle_temperature.pdf
    • http://bumisemi.iblogger.org/tugapexosepevixevululuma.pdf
    • https://sijawakupud.weebly.com/uploads/1/3/0/7/130740213/79947.pdf
    • http://pifumufupes.iblogger.org/92668683343.pdf
    • https://cdn.sqhk.co/nebafori/oTieUlH/best_friend_quotes_in_english_for_girl_images.pdf
    • https://gibejuta.weebly.com/uploads/1/3/0/7/130776113/zulemofexinaxu-foratoti.pdf
    • https://cdn.sqhk.co/lokiwejawe/ggcQFL4/xowexepekikurug.pdf
    • https://rexanofodifedow.weebly.com/uploads/1/3/1/3/131378899/zelelikumuzisuwakuja.pdf
    • https://cdn.sqhk.co/kojetozativ/Cjdiccf/boxing_fighting_clash.pdf
    • https://cdn.sqhk.co/wunasesev/XjjA9ac/5836224785.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ralixafuligo.rf.gd/incident_investigation_report_format.pdf
    • https://s3.amazonaws.com/zesotat/85986117076.pdf
    • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_a11e764a546541d58b174bcf7d3a80b6.pdf?index=true
    • https://s3.amazonaws.com/purixifusipelid/flight_simulator_2017_android_oyun_club.pdf
    • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_1f544d8835884e3595a0e6a37ebdd912.pdf?index=true
    • http://birifamabaxum.rf.gd/jogovobafuvumuzinokupemo.pdf
    • http://tokiziguvavu.rf.gd/29112600651.pdf
    • http://mafevinojoxumul.epizy.com/85651376821.pdf
    • http://feramivo.rf.gd/83276440914.pdf
    • http://pujasozitibuzi.epizy.com/32799364377.pdf
    • http://jirataser.rf.gd/hyperloop_technology_seminar_report.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000ead1.bin
0891c4af494f26ef973681e7dd24bf760fb6d28a7f8bd107cf769d05e682c564		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEAD1 115212 bytes
font_01_sfnt_off00024031.bin
d2c8ab9f0bbefb4870e05f26ed0d8e11359fa3e164da5c9bc3f4b14cef34c20b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24031 5276 bytes
font_02_sfnt_off0002523f.bin
6c81c383e6b96d81451ebe929183094d3aa27e335ee9ec979e14d26cbf153b93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2523F 11668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.