Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5b3a4985ae0e26a…

MALICIOUS

PDF

69.3 KB Created: 2021-03-06 09:15:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12800219fd68d998b111f8b8f0b07fb5 SHA-1: 94b906bd7fd8ca9cf9e856cb437f0b272d919d0a SHA-256: f5b3a4985ae0e26aec2b7b3b9d8766145adb8d478dcbd72bcf3a736cdcc475c5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The embedded URL points to a domain associated with malware distribution, likely serving as a lure for users to download a fake Adobe Flash Player update. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to exploit user trust for malicious downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/aws?utm_term=gezginler+adobe+flash+player+son+s%25C3%25BCr%25C3%25BCm%25C3%25BCn%25C3%25BC+indir
    • https://cdn-cms.f-static.net/uploads/4459337/normal_5fd8346f0d675.pdf
    • https://static.s123-cdn-static.com/uploads/4380209/normal_600118673b5eb.pdf
    • https://static.s123-cdn-static.com/uploads/4377388/normal_5fc63113df740.pdf
    • https://static.s123-cdn-static.com/uploads/4377388/normal_5fec2f7fbf8e3.pdf
    • https://static.s123-cdn-static.com/uploads/4465938/normal_5fde9d930c378.pdf
    • https://static.s123-cdn-static.com/uploads/4490516/normal_60092382cc17a.pdf
    • https://static.s123-cdn-static.com/uploads/4421627/normal_5feb50d08cee7.pdf
    • https://cdn-cms.f-static.net/uploads/4461766/normal_60137b3170d4c.pdf
    • https://cdn-cms.f-static.net/uploads/4402720/normal_602f72e749062.pdf
    • https://cdn-cms.f-static.net/uploads/4375203/normal_6021ebb1964cd.pdf
    • https://cdn-cms.f-static.net/uploads/4455898/normal_602f3251540e5.pdf
    • https://cdn-cms.f-static.net/uploads/4391340/normal_601e4556b71b4.pdf
    • https://static.s123-cdn-static.com/uploads/4472774/normal_5fe1530161dd0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4bc21fd1-5714-4268-80ea-70bd853caea3/7441588846.pdf
    • https://s3.amazonaws.com/bejeseja/bekhayali_full_song_320kbps.pdf
    • https://s3.amazonaws.com/tokatefozude/sevajuzora.pdf
    • https://uploads.strikinglycdn.com/files/a9d5b2f0-7ed2-48a1-8f81-fa8e3927b7e9/vajanezofibelipowebudige.pdf
    • https://uploads.strikinglycdn.com/files/591d2919-e02b-4057-bd18-2d2457f644fc/14865368862.pdf
    • https://s3.amazonaws.com/takurugilij/surah_al_mulk_tafsir.pdf
    • https://s3.amazonaws.com/venunamazozuzo/definition_for_fair-mindedness.pdf
    • https://uploads.strikinglycdn.com/files/edcdeb91-2ea9-49f6-ac17-f80907fd0b7d/62743802936.pdf
    • https://s3.amazonaws.com/xepululejiwof/27847991656.pdf
    • https://uploads.strikinglycdn.com/files/96e66768-9344-46d3-8b0e-fa24f69ed7c4/kagoribefogiwofuz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf6e.bin
74ad1e12bd851a1e01af469407920d3a98d161a23b94bdb2d18c72a942a385f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF6E 5900 bytes
font_01_sfnt_off0000e334.bin
59905fee8324ec93d3bda62899a4fbfd397411ef3dfbd08874f7f5a99344dad7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE334 10432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.