Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9b7412ea0ff7d9d…

MALICIOUS

PDF

59.3 KB Created: 2020-12-19 12:38:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: a36f855c9199a7f72d5e2934fff32e3d SHA-1: 1f0a4e96dc42476dbeea8b671061b4c40d512105 SHA-256: f9b7412ea0ff7d9d856e0dc17af53ea1eb68164fb2d1471b0ce91a94450d260e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, which is likely used to deliver a malicious payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to a crossword puzzle.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=lively+ballroom+dance+crossword+answer PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4456999/normal_5fcd7d46ce3f9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465564/normal_5fa8bcc7c5df0.pdfIn PDF document text
    • https://wapubepedud.weebly.com/uploads/1/3/1/4/131455956/e04b761e8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393183/normal_5fd07ab746660.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379485/normal_5f8c6346bab84.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4466140/normal_5fc3810a58bcb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412394/normal_5fa5431283e17.pdfIn PDF document text
    • https://tebadigizowi.weebly.com/uploads/1/3/4/1/134109241/pegulozinol_tukadizasabun_dudujasewikos.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fewunadupop/soguronovamelilegatuxam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16e4eec5-75d8-4712-b73f-89f9bb618a47/how_to_pair_jam2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2341ef1c-9001-4d7a-a541-2932fa8c6e55/90412795476.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09a27192-07b9-4856-946a-1ac0324e8a4a/why_do_marines_eat_crayons.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ead0e9b0-e50b-47c2-b76e-1c6e3acccec3/senixitetadi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ab3b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAB3B 5420 bytes
SHA-256: 8c8a79675e4e06bc343fab681877f9955c3e72bddd90160029eab71e292cc133
font_01_sfnt_off0000bda9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBDA9 10232 bytes
SHA-256: 4fc157c028f52b3430674110dfb71c187df141af6c50eac6236b680289d7573b

Open this report in the interactive analyzer, or submit your own file for analysis.