Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9fd57a235dff59f…

MALICIOUS

PDF

74.4 KB Created: 2021-06-10 05:17:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d9be7f4c1c9279222d89152dad79ca81 SHA-1: c3015cde8b789224a26d32f62700f28b277f0543 SHA-256: f9fd57a235dff59fe0170c074347bf25fb1da293f1c9d578c6c61e10df7e25a2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, https://krisoc.ru/pbw?utm_term=free+roms+3ds+download, suggests a phishing or malware distribution lure. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs are common in phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/pbw?utm_term=free+roms+3ds+download
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pebokuvog.pbworks.com/w/file/fetch/144646626/rainbow_vacuum_parts_diagram.pdf
    • https://uploads.strikinglycdn.com/files/fc81d1ce-5f5f-4f01-970b-21b3021f0020/city_of_glass_paul_auster_book_review.pdf
    • https://uploads.strikinglycdn.com/files/8974b7bf-0ce9-44a6-8769-6764764f644f/pubewefinabudefob.pdf
    • http://podixarutib.pbworks.com/w/file/fetch/144791355/98789994610.pdf
    • http://volikedejefa.pbworks.com/w/file/fetch/144615384/prayers_that_move_mountains_john_eckhardt_free.pdf
    • http://mifimoruzuwo.pbworks.com/w/file/fetch/144465444/88262375911.pdf
    • http://liguduper.pbworks.com/f/kosobizogutizexutukiwi.pdf
    • https://uploads.strikinglycdn.com/files/e73bf03b-23e3-4224-81e6-18cc1c1b3a15/olympus_om_10_manual_adaptor.pdf
    • http://tedadopite.pbworks.com/f/53456478534.pdf
    • https://uploads.strikinglycdn.com/files/cb806f55-1d9a-4260-80a3-db9c38de3457/resuxakuwiloketowute.pdf
    • https://uploads.strikinglycdn.com/files/f399d377-1275-4307-9f93-ba2d7dcc0f0a/niv_rainbow_study_bible_amazon.pdf
    • https://uploads.strikinglycdn.com/files/a1ee3262-0fc8-4e8d-b527-b6f886c4515c/jokiwuwugelofolerokari.pdf
    • http://larabefejaji.pbworks.com/w/file/fetch/144555648/tomunenizari.pdf
    • https://uploads.strikinglycdn.com/files/6e96999e-9097-495d-8b66-4de7ccf5b241/how_to_load_swingline_high_capacity_heavy_duty_stapler.pdf
    • https://uploads.strikinglycdn.com/files/3b920dc1-3230-4d17-b597-ac9cff971089/86479459897.pdf
    • https://uploads.strikinglycdn.com/files/6f9f83d8-0a3b-46ed-9577-cc5716eeaa86/guzusudojonifovesaw.pdf
    • https://uploads.strikinglycdn.com/files/9e3cbb9c-34ae-41ab-bcb7-4d03605adfa3/calculus_early_transcendentals_2nd_edition_by_briggs_cochran_and_gillett.pdf
    • https://uploads.strikinglycdn.com/files/e6a3298c-6c38-4b44-9712-369f85c7e3df/river_flows_in_you_yiruma_fingerstyle_guitar_lesson_tutorial_how_to_play_fingerstyle.pdf
    • https://uploads.strikinglycdn.com/files/ea65f672-66d8-4ba4-a03c-17e567d36718/5533508315.pdf
    • http://pilujibos.pbworks.com/w/file/fetch/144492033/6876485445.pdf
    • https://uploads.strikinglycdn.com/files/9ef8bc2c-a72e-4b4b-8c76-12268cebcace/4728738160.pdf
    • http://viforepolu.pbworks.com/f/magnesium_oxide_is_ionic_or_covalent.pdf
    • http://pafunanukexe.pbworks.com/w/file/fetch/144939723/jiguxitokarubekinogu.pdf
    • http://sukagafamo.pbworks.com/w/file/fetch/144729549/is_there_a_tv_guide_app_for_fire_stick.pdf
    • http://jolunatimavu.pbworks.com/w/file/fetch/144791856/how_to_start_dating_format.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e69e.bin
04f30ee6ecc0ba463a01e3e25a674a91d016a877243c8d81aa6506ab12e4eee8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE69E 5184 bytes
font_01_sfnt_off0000f838.bin
bbc47a6a7ca18afcfd2afee8376ebec6ea1e8c68adb3149b6a7563ec3b23a9ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF838 10524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.