Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9d3f9b2e14fe720…

MALICIOUS

PDF

204.3 KB Created: 2021-04-03 04:05:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 0041a5f8fe98916e571a6bd038f65168 SHA-1: 5720e254982bbec363632daa0225c5391de0cc5a SHA-256: f9d3f9b2e14fe72048b262b837b22806e5d06ba97b9b3392c2230e1d3f497b76
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7027

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=ipa+phonetic+symbols+pdf PDF link annotation
    • https://cdn.sqhk.co/bidogefapo/hbgfiiY/the_maxwell_apartments_san_antonio.pdfIn PDF document text
    • https://cdn.sqhk.co/jojojidatun/jg0gchi/farm_guns_alien_clash_2018.pdfIn PDF document text
    • https://cdn.sqhk.co/zumufapofow/Wjbhajc/kung_fu_monkey_board_game.pdfIn PDF document text
    • https://cdn.sqhk.co/saboretiki/Vibhi77/enoshima_weather_report.pdfIn PDF document text
    • https://cdn.sqhk.co/sadirorig/Asjf8jg/3389507143.pdfIn PDF document text
    • https://cdn.sqhk.co/dewavasese/bjbicQA/91813204584.pdfIn PDF document text
    • https://cdn.sqhk.co/gabunufu/dsGf5Tt/abc_song_nursery_rhymes_wiggles.pdfIn PDF document text
    • https://cdn.sqhk.co/janezewufaj/fZRMwic/8852526829.pdfIn PDF document text
    • https://cdn.sqhk.co/punipopi/jiixBgi/movies_coming_to_starz_october_2020.pdfIn PDF document text
    • https://cdn.sqhk.co/pupumukisev/WifkoX8/32482884314.pdfIn PDF document text
    • http://nugowimabu.mywebcommunity.org/mcdonalds_coupons_mrz_2020.pdfIn PDF document text
    • https://cdn.sqhk.co/lasesekov/cCjjrhe/dissidia_final_fantasy_opera_omnia_character_list.pdfIn PDF document text
    • http://penageli.getenjoyment.net/27406478379.pdfIn PDF document text
    • http://fijazubelanulek.mywebcommunity.org/xepalupimujaso.pdfIn PDF document text
    • https://cdn.sqhk.co/tinolefowi/ejeZmhh/zara_home_mexico.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bonizeza.epizy.com/98948662661.pdfIn PDF document text
    • http://bibezakomi.myartsonline.com/bojenekupoxajapaputodeloj.pdfIn PDF document text
    • http://sajurewe.rf.gd/ronco_3000_showtime_rotisserie_gloss_black.pdfIn PDF document text
    • https://s3.amazonaws.com/kukupunopedon/mebakuwixafobekogupubikep.pdfIn PDF document text
    • http://tiluxusimutine.atwebpages.com/72611636081.pdfIn PDF document text
    • http://xipitidugizen.rf.gd/bhopal_express_platform_no_in_nizamuddin.pdfIn PDF document text
    • https://s3.amazonaws.com/kobivimelelo/72604032743.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000248a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x248A7 6512 bytes
SHA-256: 28e982640cdb4d722f47576ad6991eb05446892e9eb7ea04aa12983addb36a2e
font_01_sfnt_off00025874.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25874 2912 bytes
SHA-256: 379102226829f3bab3a3c763e92e857047a50d0750f2cd7a3c42e86eaecd7746
font_02_sfnt_off000262d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x262D8 5476 bytes
SHA-256: d842c4668fd850d90539770600e15d0573849c6db96174e1a9e174a9095a024b
font_03_sfnt_off00027550.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27550 2456 bytes
SHA-256: ea7c0c0211ebe982041670717df575d7e7d464ac405d52dceff550b28dd84317
font_04_sfnt_off0002806b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2806B 42304 bytes
SHA-256: e432bb14292cb4ee295a04fa4bde8bf25b4ec50e20f3836210d6e959c7377493
font_05_sfnt_off0002f990.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F990 17004 bytes
SHA-256: fe0435231db730c1f8e7ff96ad0e106552f40a364455ff867fa3dfbee4a355fb
font_06_sfnt_off000311ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x311AD 6240 bytes
SHA-256: e77e6cddc222dbcc433114edb339bf25a2c6245c3eaad09226e92c59da7ae1c1

Open this report in the interactive analyzer, or submit your own file for analysis.