Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4191ef0a1063cb3…

MALICIOUS

PDF

79.3 KB Created: 2021-04-04 18:56:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 67c0eed222f1d0d0a1b0449e795ee3f2 SHA-1: 7a9417b79fa00f88d54c6eb8670823faadc43bbf SHA-256: f4191ef0a1063cb3e2530bba3106211aa23291b654dcc73d2c1bb33eea72d7ae
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs are indicative of a lure to a malicious site, likely for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=auditory+learning+style+pdf
    • http://rubewox.sportsontheweb.net/48474839063.pdf
    • https://cdn.sqhk.co/gorubabor/ii0ifja/audio_bible_telugu_apk.pdf
    • http://bestrongbyg.com/vokapubasumikabewlsb8c.pdf
    • http://sukutoxuwurif.mywebcommunity.org/modowizazulatubulalefiz.pdf
    • https://cdn.sqhk.co/sutekepape/TUwbhia/kowifinidekudobul.pdf
    • http://7evenrp.ru/70948760253583wd.pdf
    • http://tulomodev.getenjoyment.net/graphlab_python_3.6.pdf
    • http://kudukudimox.sportsontheweb.net/how_to_set_timer_on_boiler_worcester.pdf
    • http://peuly.xyz/causative_have_and_get_exerciseznvs9.pdf
    • http://tk-time.site/48485280948armle.pdf
    • https://cdn.sqhk.co/sisagoku/Cowjfwa/64764951109.pdf
    • https://cdn.sqhk.co/fejavegiwo/9VHqUgg/fat_cat_jump_fail_gif.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vogonadebemumox.epizy.com/pathfinder_character_sheet_excel_template.pdf
    • https://uploads.strikinglycdn.com/files/ddd32696-77ad-40dc-a832-e050aeacb4f4/pusegomero.pdf
    • http://kupikobu.epizy.com/momirefigi.pdf
    • http://zutadefado.epizy.com/tupowojagovadibod.pdf
    • http://vupaguriwedizid.atwebpages.com/understanding_and_using_english_grammar_third_edition_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/3de7837a-78c1-4648-a5c6-8a52635a7685/my_license_says_not_for_real_id_purposes_nj.pdf
    • http://boribasumagit.epizy.com/42511284128.pdf
    • https://uploads.strikinglycdn.com/files/b998af76-8812-458f-83e7-b24cbc6532ad/what_characters_are_in_jump_force_deluxe_edition.pdf
    • https://uploads.strikinglycdn.com/files/a9080885-4456-4908-b951-c9e308e2caba/86856432676.pdf
    • https://uploads.strikinglycdn.com/files/40e5261c-3238-4c2e-8c3b-fabe8d338d00/onkyo_tx-nr616_7.2-_channel_network_a_v_receiver.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fafa.bin
aaf4991daa93b04b63c748fa1b3896e5eadd97250022d899419985b026e06d1c
pdf-font-stream PDF embedded font (sfnt) at offset 0xFAFA 5300 bytes
font_01_sfnt_off00010d1e.bin
77040ba0e1c5b78c3e065bf4cc456846795876c518b2c42974eb0748f23595ce
pdf-font-stream PDF embedded font (sfnt) at offset 0x10D1E 10260 bytes