Malicious PDF — malware analysis report

Static analysis result for SHA-256 f79ad5def99c4ba0…

MALICIOUS

PDF

74.7 KB Created: 2021-03-24 07:37:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 45e84be0917fcc62da0383532280b6ea SHA-1: b18a833433ef34f9687bf594ee6f5f2444d7f541 SHA-256: f79ad5def99c4ba0baa72bfa23331058dae316312caae9bf6b9ce9e15403beab
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9948

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=primary+light+colours PDF link annotation
    • http://sungo1.space/bewars_audio_naa_songs_free2yd82.pdfIn PDF document text
    • http://maykistore.ru/adobe_premiere_pro_video_editing_tutorialt1v4d.pdfIn PDF document text
    • https://cdn.sqhk.co/rasepotobami/xLhgidm/90135012007.pdfIn PDF document text
    • https://cdn.sqhk.co/letarezetap/2fjdugc/candomble_religion.pdfIn PDF document text
    • http://bupro.asia/13959374495xfet4.pdfIn PDF document text
    • http://honey-love.ru/john_deere_mower_seat_coverl0wqf.pdfIn PDF document text
    • http://tugrull.com/netflix_movies_offline_on_macyvtbd.pdfIn PDF document text
    • https://cdn.sqhk.co/zosikoto/chamicz/47939711452.pdfIn PDF document text
    • http://pubggaming.online/vunelawabisakuidnnh.pdfIn PDF document text
    • http://bossyonlinex.com/mtc_bus_rush_hoursi3l9v.pdfIn PDF document text
    • http://excschool.ru/brain_rules_for_baby_john_medina_free_download2kup4.pdfIn PDF document text
    • http://hydrofthol.space/882000753825qndy.pdfIn PDF document text
    • https://cdn.sqhk.co/xamitarerivu/giigha9/bofipuzanewubedi.pdfIn PDF document text
    • http://goods-amzon.com/dengeki_bunko_crossing_void_apk_englishzzg6p.pdfIn PDF document text
    • http://usesol.xyz/7072835943941le6.pdfIn PDF document text
    • http://copyrightnotice-ig.com/jonesboro_ga_weather_reportvtp2i.pdfIn PDF document text
    • http://sentytld.online/361940805687ce0b.pdfIn PDF document text
    • http://naturebiolog.fun/38051153904ctwg3.pdfIn PDF document text
    • http://getveran.site/washington_post_covid_articledp8m7.pdfIn PDF document text
    • https://cdn.sqhk.co/sesijisova/ejdUihV/rosamufikatefajozamikaz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/divexikav/keburalesozagazewedojover.pdfIn PDF document text
    • https://s3.amazonaws.com/fupanabivote/powerpoint_wheel_template.pdfIn PDF document text
    • https://s3.amazonaws.com/watajive/aflac_short_term_disability_claim_form_florida.pdfIn PDF document text
    • https://s3.amazonaws.com/jebokizez/kifodigosagefowagavebawu.pdfIn PDF document text
    • https://s3.amazonaws.com/zozuxukoxo/sodium_carbonate_msds.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/how_to_take_apart_a_presto_dehydrator.pdfIn PDF document text
    • https://s3.amazonaws.com/lanaladu/61070780612.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8AF 4976 bytes
SHA-256: b28141d74440fa3d80ac562ae54c59248a8a13b4261061228646af26dddb6643
font_01_sfnt_off0000e98c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE98C 11008 bytes
SHA-256: 2973bb724b6fceabe9c795bab47021e4ac08df8ba340efb73ae2d4127a5ce781
font_02_sfnt_off00010ea7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EA7 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.