Malicious PDF — malware analysis report

Static analysis result for SHA-256 f333af5545837275…

MALICIOUS

PDF

85.2 KB Created: 2021-06-26 07:04:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e9b6bbc8afab47bddbd377fd3128441e SHA-1: f9ade258b923d256cc3b123d29a3526d7048ff7b SHA-256: f333af5545837275f5fb01339910bbedae1502daef0eb2265ff292fe1e0e800e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a domain known for phishing and malicious content. The document body, though heavily obfuscated, appears to be related to the URL's keyword, suggesting a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/wb?keyword=how%20much%20does%20app%20development%20cost%20in%20india
    • https://cdn-cms.f-static.net/uploads/4470387/normal_60bf300eba054.pdf
    • https://static.s123-cdn-static.com/uploads/4421200/normal_5fe2ff3e493c4.pdf
    • https://cdn-cms.f-static.net/uploads/4454043/normal_5fd67d5c3dd60.pdf
    • https://static.s123-cdn-static.com/uploads/4367961/normal_5ff13308b5f89.pdf
    • https://cdn-cms.f-static.net/uploads/4486344/normal_605f85d7cd7fa.pdf
    • https://cdn-cms.f-static.net/uploads/4381083/normal_605d69dbb6e23.pdf
    • https://cdn-cms.f-static.net/uploads/4495999/normal_605480aeafb5e.pdf
    • https://cdn-cms.f-static.net/uploads/4413843/normal_60677af58a995.pdf
    • https://cdn-cms.f-static.net/uploads/4408718/normal_6037b7eb35deb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://ralabasom.pbworks.com/f/after_we_collided_book_free_read.pdf
    • http://nugewil.pbworks.com/f/toefl_ibt_sample_questions.pdf
    • http://vananizi.pbworks.com/f/true_skate_apk_mod_all_skateparks_download.pdf
    • http://rupebaxo.pbworks.com/f/62848533694.pdf
    • http://fiseguxu.pbworks.com/f/lalitha_banjara_dj_songs.pdf
    • http://nixefijevumu.pbworks.com/f/7238255584.pdf
    • http://nemupaludol.pbworks.com/w/file/fetch/145286916/lonobomati.pdf
    • http://paditoxef.pbworks.com/f/download_muskurane_ki_wajah_tum_ho_mp3.pdf
    • http://tujezowosop.pbworks.com/w/file/fetch/144739731/76785492650.pdf
    • http://wenitat.pbworks.com/w/file/fetch/144544881/31064200365.pdf
    • http://posonuxe.pbworks.com/w/file/fetch/145083171/befaxapikutoramotut.pdf
    • http://jomomaxade.pbworks.com/w/file/fetch/145278915/45006699944.pdf
    • http://javefanudosa.pbworks.com/f/69565637973.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101dc.bin
1eb6d2b74ea4c7d2dcf2c0a30f0f51167c0943d36d7a7900cf8baf5a40661d6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101DC 5212 bytes
font_01_sfnt_off0001138c.bin
36356086bbcb603ec781fb1f6be990597719a0128898f3f6986d112afc53a177		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1138C 10996 bytes
font_02_sfnt_off000138da.bin
8405bb6ca9a6fb718a2e910e1cdde4d74ac2122cab0061dc5f772322db9c7ccd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x138DA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.