Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4dfa43db12b4faa…

MALICIOUS

PDF

94.6 KB Created: 2021-03-23 09:50:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 821a4a265bfe4ed48bb7e61e6b6c4084 SHA-1: efce50ff592a2cda980a22262eebeb509a9dedfd SHA-256: f4dfa43db12b4faae16d1030a55934e00f7549e969503b94d7326ba360353c9b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL disguised as a search result. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The PDF_URI heuristic points to a specific URL that is likely used to host malicious content or redirect the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=yoruba+creation+myth+story
    • https://cdn-cms.f-static.net/uploads/4493890/normal_604a897b97ca0.pdf
    • http://kraftmann.su/skewed_data_transformationu2vwr.pdf
    • http://meboxofunufox.iblogger.org/how_to_clean_braun_series_7_base.pdf
    • http://loleveze.iblogger.org/what_are_the_uses_of_writing_system_in_ancient_egypt.pdf
    • http://buvavarosavadar.iblogger.org/11805461283.pdf
    • https://cdn-cms.f-static.net/uploads/4403273/normal_5fd8b7b94756e.pdf
    • https://cdn-cms.f-static.net/uploads/4465701/normal_6036a473406de.pdf
    • http://bekavukida.22web.org/18270148689.pdf
    • http://shortsomfj.space/sipimulonapuginupub9nlvy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_6716c8478607480f91eb1ed2d48e819e.pdf?index=true
    • http://xokofenox.epizy.com/css_grid_layout_template.pdf
    • http://bulexaresozo.rf.gd/62268807543.pdf
    • http://zigetolerup.epizy.com/dork_diaries_author_facts.pdf
    • https://uploads.strikinglycdn.com/files/94f235a6-d58d-43ae-9653-7fa706cb1d90/most_popular_safety_topics_on_youtube.pdf
    • http://nuzoniwetavo.rf.gd/ropikasogodemizanemaf.pdf
    • https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_fe4737cf77eb4a42a67b6fce6608df59.pdf?index=true
    • https://a9864912-ad24-422b-99f3-2d90f7703507.filesusr.com/ugd/d6af85_841c9ef5db344bb9927b3e966c9d8a65.pdf?index=true
    • https://uploads.strikinglycdn.com/files/77dfe5fa-5f72-4836-a831-288883ed09e9/sanyo_smart_tv_models.pdf
    • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_8ab6373b64e14b62bea24536a6e16e9d.pdf?index=true
    • https://dacf5b84-f80e-4bd8-bb7f-22aad20a1cd8.filesusr.com/ugd/285be4_a5ddd35f2efa4826bc2120db03318927.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c7310fdd-bde8-4a1f-8a73-04a39a8898cb/the_chrysalids_chapter_3-4_summary.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001313e.bin
e46bde64a32bb8e791077509c7609ba09f1d98e2e0b40e711fcb88ccb3f7a64f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1313E 5212 bytes
font_01_sfnt_off000142d5.bin
2637e4c0f781c837b6657b61e83a8e9d9b3f1e8e49ff9b339229aecff3c706f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142D5 13884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.