Malicious PDF — malware analysis report

Static analysis result for SHA-256 f38ccf58a1b7498f…

MALICIOUS

PDF

82.5 KB Created: 2021-03-05 02:21:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b1c631d8e0908412a0cbd53483ad5a05 SHA-1: e1451f6a53cd4c7ae8ade109fd0b1443b95afb33 SHA-256: f38ccf58a1b7498f72068c24460355807a918567c03f5e70ab07a2e0644322b8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that points to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF as malicious. The document body contains text that appears to be a lure, referencing 'Come along for the ride meaning', which is likely a pretext to encourage clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/123?utm_term=come+along+for+the+ride+meaning
    • https://cdn-cms.f-static.net/uploads/4387929/normal_5fda56514fa55.pdf
    • https://cdn-cms.f-static.net/uploads/4413718/normal_5fd1bb66dee7c.pdf
    • http://marudibiwel.iblogger.org/90151472684.pdf
    • https://cdn.sqhk.co/xomifinetepi/gMXlBij/origami_flower_step_by_step_tagalog.pdf
    • http://ledikifakexu.22web.org/fikukefamekijofexofad.pdf
    • https://cdn.sqhk.co/tifobebe/bijNE5A/light_it_up_luke_bryan.pdf
    • http://banolapisa.iblogger.org/glioma_contouring_guidelines.pdf
    • https://cdn.sqhk.co/letareximo/bvLBtoW/37237042327.pdf
    • https://static.s123-cdn-static.com/uploads/4467273/normal_5ffea21196f47.pdf
    • https://cdn-cms.f-static.net/uploads/4418764/normal_603b587776a3f.pdf
    • https://cdn.sqhk.co/wabasenenem/bLRz1Xn/63532121236.pdf
    • https://static.s123-cdn-static.com/uploads/4415748/normal_5ffda743613e7.pdf
    • https://cdn.sqhk.co/vovewotutal/gd4Zghg/ruluzimerepuneliru.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tujulerika.epizy.com/neninunojerenoduditux.pdf
    • http://zetazuzetebutef.epizy.com/first_90_days_app_michaela_watkins.pdf
    • https://uploads.strikinglycdn.com/files/1918036e-2a55-4848-89ca-57813b1e7db7/what_to_write_in_your_godsons_first_birthday_card.pdf
    • https://uploads.strikinglycdn.com/files/b3b2ae73-748b-40c3-98d8-2e181e6d18c1/64696542366.pdf
    • https://uploads.strikinglycdn.com/files/127289e1-a178-4d28-a149-bbdd0a313a45/kotowizopufasapamunujuv.pdf
    • https://uploads.strikinglycdn.com/files/4e5f2893-8b03-40d2-a509-1a98b6a203b5/gogax.pdf
    • https://uploads.strikinglycdn.com/files/cc79bea8-3467-41bd-9e0a-37169c428fa1/45367953415.pdf
    • https://uploads.strikinglycdn.com/files/717c4723-93ca-467a-9830-326bfeec94a6/vokenogugutopusif.pdf
    • http://desorebo.epizy.com/7741088599.pdf
    • https://uploads.strikinglycdn.com/files/175bbf9a-25b1-46ad-bbc7-d39e2429b963/8466256125.pdf
    • https://uploads.strikinglycdn.com/files/33a2de6d-c61f-4c42-b824-7b7b96bb266e/solazozomivudokexatuval.pdf
    • http://gagarereforer.epizy.com/guidepost_montessori_at_brushy_creek.pdf
    • http://forolulazo.rf.gd/how_to_put_bobbin_in_old_singer_sewing_machine.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105af.bin
0e71e1c7ab42bf9ca78505d0527c2188cba508391a82880d613b30ea3ee45bac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105AF 5048 bytes
font_01_sfnt_off000116a8.bin
0e6b07f05d8fd8291e88bc5025ef4483de89ef81fc4788fc4ace386bb60e62b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116A8 11148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.