Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9a01837c842f7b8…

MALICIOUS

PDF

81.9 KB Created: 2021-04-01 08:04:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a5bd7594442138c86f67039b5539ea34 SHA-1: adb36745bac1f1f4df47d40f6e3f5bad370aa94d SHA-256: f9a01837c842f7b852fa722801b900d84d1ebe516cb886250913093969430703
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, and ClamAV detection confirms its malicious nature. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, suggests a lure related to the 'Lord of the Rings' trilogy timeline, likely intended to trick users into visiting the external URL for further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=lord+of+the+rings+trilogy+timeline
    • http://czecheducation.space/sobuwamozgmn.pdf
    • https://cdn-cms.f-static.net/uploads/4455881/normal_6064e84bd9339.pdf
    • https://fujokexa.weebly.com/uploads/1/3/5/3/135304253/643b0091a33.pdf
    • https://static.s123-cdn-static.com/uploads/4460076/normal_5fcaf37a76ca7.pdf
    • http://igonlinesupport.com/my_big_book_of_questions_and_answersqdklr.pdf
    • https://nogomikosisodop.weebly.com/uploads/1/3/2/6/132681488/kiwoteduwevoden.pdf
    • https://static.s123-cdn-static.com/uploads/4470552/normal_5fe1a11f29366.pdf
    • http://yandex-dostav.ru/dogunorinupezutipakthzo.pdf
    • https://static.s123-cdn-static.com/uploads/4425915/normal_5ff1470fd90c9.pdf
    • https://cdn.sqhk.co/jesisuvov/dUApibR/2nd_grade_math_lesson_plans_addition.pdf
    • https://cdn.sqhk.co/nakunadubux/tOjahjh/72760180659.pdf
    • https://cdn-cms.f-static.net/uploads/4468540/normal_60567409e94d0.pdf
    • http://coins24h.com/how_do_i_get_the_volume_back_on_my_vizio_tvph02f.pdf
    • http://copyrightnotices-form.com/the_tower_of_nero_the_trials_of_apollo_book_5_summaryuc3ri.pdf
    • https://cdn.sqhk.co/vujaderaz/gPjc84L/gun_reload_sound_effect_free_download.pdf
    • https://cdn-cms.f-static.net/uploads/4387924/normal_60158d1aae6e4.pdf
    • https://jonimewogil.weebly.com/uploads/1/3/1/8/131860125/9577646.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/665b05bd-7ac4-48aa-9a72-bcd892b3d8a0/oster_toaster_oven_manual_tssttvcg02.pdf
    • https://uploads.strikinglycdn.com/files/086ccdc3-2646-4985-a7bc-92fb8e342f7a/fotowa.pdf
    • https://uploads.strikinglycdn.com/files/ffd9a2f6-e0d2-4011-b423-4e88181de72c/tujonovimifiwuju.pdf
    • https://uploads.strikinglycdn.com/files/59803a6c-303d-42dc-b5b2-584504813cd3/how_much_does_garbage_disposal_installation_cost.pdf
    • https://uploads.strikinglycdn.com/files/344817f2-85a1-4a70-879d-d988dd8a001b/bufovubovibadod.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001029e.bin
50990d9454406fe001c2afe6ebdb603c19923575e7177c4563dd712976989e38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1029E 5152 bytes
font_01_sfnt_off00011411.bin
bbdc31ebcd98194316e71a531d8eac1cc5f93fb8f43b574c705f3be103e1c332		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11411 11256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.