Malicious PDF — malware analysis report

Static analysis result for SHA-256 f784cbf16a2f1604…

MALICIOUS

PDF

85.2 KB Created: 2021-03-30 01:48:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 95a76106a252b1f3eee55c7d27cc7995 SHA-1: b1070fb1b7873be07cd45fa1e432c5778b505732 SHA-256: f784cbf16a2f16041fd072a0809f5f4f6f4e65a874390cbed0df2cf721a87e8c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body is heavily obfuscated, but the presence of the external URI suggests a social engineering attempt to trick the user into visiting a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=what+is+the+main+theme+of+the+house+on+mango+street
    • https://cdn-cms.f-static.net/uploads/4447434/normal_6058e92655913.pdf
    • https://static.s123-cdn-static.com/uploads/4365551/normal_5fe3de423c860.pdf
    • http://badgesverified.com/75835277713zfy3v.pdf
    • https://cdn-cms.f-static.net/uploads/4376599/normal_5fdb6422cda3f.pdf
    • http://paxijivatebul.getenjoyment.net/tonipotelewabezagux.pdf
    • http://zozamowewideno.mypressonline.com/learn_english_communication_skills.pdf
    • https://cdn-cms.f-static.net/uploads/4481406/normal_5fd37870928d5.pdf
    • https://cdn-cms.f-static.net/uploads/4476567/normal_605508821a90c.pdf
    • https://cdn.sqhk.co/rejoxapuzopa/VAhhEge/27848354017.pdf
    • https://static.s123-cdn-static.com/uploads/4393779/normal_5ff001fbb80c3.pdf
    • https://static.s123-cdn-static.com/uploads/4495058/normal_5fddb12742072.pdf
    • https://cdn.sqhk.co/bedogipaxog/ZWqEffY/nick_cannon_net_worth_2020_forbes.pdf
    • http://airned.ru/tifidakuvuwugnygbo.pdf
    • http://exampl1214.com/1131780602vmq7v.pdf
    • https://cdn-cms.f-static.net/uploads/4392664/normal_605b1f61777f1.pdf
    • https://cdn.sqhk.co/pixafosabow/6HKjgBu/gimikamuvopimabarawi.pdf
    • http://bossyonlinex.com/what_are_essential_components_of_missionfbix2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f702ae5a-1f42-4f77-8c7a-31ec2a25fa31/buxita.pdf
    • https://uploads.strikinglycdn.com/files/1053a3d8-9187-4363-9290-5253420d18f3/87719193484.pdf
    • https://uploads.strikinglycdn.com/files/b1ae9e79-1cec-4b95-b81d-18888683046a/lofamelafebojodesu.pdf
    • https://uploads.strikinglycdn.com/files/85fff6db-eb2f-4693-9ab7-d37d9f8113d5/how_many_calories_in_taco_bell_mini_chicken_quesadilla.pdf
    • http://rulamiji.onlinewebshop.net/920094043.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f94c.bin
4d5910e4defc9cbff8c02a5f851d09978189c4b1867daed5f1dabc4c73daa53e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF94C 5160 bytes
font_01_sfnt_off00010abe.bin
198a6df1231ae71ab02ec23a53da57e207d8fcc0f7228020a0add4755747673a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10ABE 11432 bytes
font_02_sfnt_off000130f3.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130F3 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.