Malicious PDF — malware analysis report

Static analysis result for SHA-256 f87b99ea70efa7d4…

MALICIOUS

PDF

76.3 KB Created: 2021-04-23 20:53:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 72cefe9b99a93673c84aba70fcf84ea3 SHA-1: 5c3a011772a6023a782cb3ac1362daf1eee3e6df SHA-256: f87b99ea70efa7d403deb84918e12ce9d3c6be7e88efb150485c7ba4fa2d9cd2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by ML classifiers and ClamAV as malicious. The document body, though heavily obfuscated, suggests a lure related to 'The stages of the hero's journey pdf'. The presence of multiple unknown URLs further supports a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=the+stages+of+the+hero%2527s+journey+pdf PDF link annotation
    • http://best-ital.fun/reasons_my_dryer_wont_heatdajen.pdfIn PDF document text
    • http://koreanluxe.com/dukuzagepigimabezafusawwocto.pdfIn PDF document text
    • http://priz24.site/69433474129lse5e.pdfIn PDF document text
    • http://mybestchan.online/6638814696143i5n.pdfIn PDF document text
    • http://rirarojafetojep.iblogger.org/victorian_age_of_english_literature.pdfIn PDF document text
    • http://drive4mclanemilwaukee.com/petegawuzomajujwvc3.pdfIn PDF document text
    • http://pigetubivefenux.22web.org/17192288501.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sajezife/poxabaxirex.pdfIn PDF document text
    • https://s3.amazonaws.com/jarawaxanivu/simple_elimination_method_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/ladiwuzetawedi/kebaxamuvonipudufamobiga.pdfIn PDF document text
    • https://s3.amazonaws.com/vuzufexarevima/canon_eos_t5_manual.pdfIn PDF document text
    • http://deweperiji.epizy.com/relentless_from_good_to_great_to_unstoppable_by_tim_grover.pdfIn PDF document text
    • http://zovagupegi.rf.gd/lipevelajimozo.pdfIn PDF document text
    • https://s3.amazonaws.com/jijumupade/central_hidroelectrica_cerro_del_aguila.pdfIn PDF document text
    • https://s3.amazonaws.com/fedufiporara/temporal_process_of_zygomatic_bone_information.pdfIn PDF document text
    • https://s3.amazonaws.com/metubevozisul/maxi_cash_annual_report_2016.pdfIn PDF document text
    • https://s3.amazonaws.com/pulujolatepuv/60709412622.pdfIn PDF document text
    • http://kotumeberi.rf.gd/95066643898.pdfIn PDF document text
    • https://s3.amazonaws.com/vawoginele/hiatal_hernia_nutrition.pdfIn PDF document text
    • https://s3.amazonaws.com/tomamujuf/noleki.pdfIn PDF document text
    • https://s3.amazonaws.com/mibiwivanetuj/bengali_new_album_song.pdfIn PDF document text
    • http://wobemiko.epizy.com/84055165238.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB3C 5432 bytes
SHA-256: b03e8e51541fa267c969f79f131738938592a0426af57bf625d450087397c282
font_01_sfnt_off0000fdcb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDCB 10564 bytes
SHA-256: 0c0c9c37f6067315499c61c8bf2420e373752eca4e2911dcfd4d3a67695ac745

Open this report in the interactive analyzer, or submit your own file for analysis.