Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9b23eec32bfdf5f…

MALICIOUS

PDF

396.5 KB Created: 2021-03-17 09:20:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 784a99f4fa96c94a59df0e71a512bf6c SHA-1: ddc6c8970ad109bcb58f4071aff08638dd53759c SHA-256: f9b23eec32bfdf5fdb99a8de8746eea6955cb9a4c482da44609dc1d3d9d12fd1
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that exhibits characteristics of an advance-fee scam, using lottery or prize language to entice the user. It contains a link to a known malicious redirector, suggesting it is used to deliver further malicious content or phishing pages. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9529

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/wix?keyword=pertaining+to+across+the+abdomen+medical+term
    • http://creampiepow.club/richard_l_daft_management_11th_editiiavcy.pdf
    • http://theharaka.online/mims_drug_handbook_2018_free_downloadpe0ef.pdf
    • https://cdn.sqhk.co/rijolumexeb/Ijf3u0B/tugixusatakesilafuniwuzu.pdf
    • https://cdn.sqhk.co/linidivez/phggRjc/72646379755.pdf
    • https://cdn.sqhk.co/sofizagumup/icibnYs/20841110961.pdf
    • http://bafedudovodamo.medianewsonline.com/fafazisarerofudawo.pdf
    • http://fesunasisodenod.getenjoyment.net/pemenaguguralubeti.pdf
    • http://odebayitrafikhizmeti.com/punching_shear_calculation_spreadsheet665s1.pdf
    • https://cdn.sqhk.co/dilobowuz/eB2qVon/58248023442.pdf
    • https://cdn.sqhk.co/dawafawux/yhdhi1T/fatugov.pdf
    • http://faxusupovetek.sportsontheweb.net/como_pasar_gramos_a_miligramos.pdf
    • https://cdn.sqhk.co/mafowixodi/tqjaRc7/24840693064.pdf
    • https://cdn.sqhk.co/gasosivifug/iiggjid/kurumowadogumatetenukuna.pdf
    • https://cdn.sqhk.co/remudejifi/Ygefgfq/knight_rider_movie_2015.pdf
    • http://habirovradik.ru/born_a_crime_audiobook_chapter_1b7s94.pdf
    • https://cdn.sqhk.co/vegedusovo/q1hgsSp/33127337499.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bebojivim.myartsonline.com/characteristics_of_sound_in_physics.pdf
    • https://s3.amazonaws.com/daniwodug/angry_birds_epic_rpg_apk_ios.pdf
    • https://uploads.strikinglycdn.com/files/1436160c-3e35-4576-988c-821e024da022/fusorejadojedidosuvu.pdf
    • https://uploads.strikinglycdn.com/files/2bae733c-e90f-4eff-be9c-0597c93bf7a4/gerunds_and_infinitives_exercises_grammar_bank.pdf
    • https://s3.amazonaws.com/zuxime/precalculus_worksheets_with_answers.pdf
    • https://s3.amazonaws.com/juwofuxufijup/what_are_the_examples_verb_phrase.pdf
    • https://uploads.strikinglycdn.com/files/66f0d668-8089-417e-b361-66eae48181c2/18045326130.pdf
    • https://uploads.strikinglycdn.com/files/4046b21c-0a2b-477a-a17b-a1354ede8b8a/zezuzute.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005c8b3.bin
8b4c8562d9a3bcf9b1079505b960d3260cc63a0018717d011b444586165c6416		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C8B3 5496 bytes
font_01_sfnt_off0005db36.bin
88c916fd44558cf204db4565a2ed05623cabc8700fd45ad1ecd1314b999fed3f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DB36 14032 bytes
font_02_sfnt_off00060a63.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60A63 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.