Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb4271cd576fbd7d…

MALICIOUS

PDF

79.7 KB Created: 2021-06-08 12:14:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 9ada410e23c4d615da61bc22db8f23ce SHA-1: 49ae1ee9099d3a0240d741f4f26afeee3f7506dc SHA-256: fb4271cd576fbd7df5718c39d615999989f8954986b049e28e46fecc8b8c5984
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that masquerades as a download link for Adobe Spark. This URI, 'https://drafthe.ru/pbw?utm_term=download+adobe+spark+for+windows+7+32+bit', is highly suspicious and likely leads to the download of malware. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/pbw?utm_term=download+adobe+spark+for+windows+7+32+bit PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4417312/normal_604a12343ae99.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454286/normal_6005f9da52eb5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368240/normal_6014c2b4c1dba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485580/normal_602a71cc4c411.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377662/normal_6068ebc43d7f9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472491/normal_60182f33c247a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385434/normal_6031ade4c21e0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475734/normal_60299ab27ea66.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454544/normal_605bfd464a15f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459794/normal_5ff8c1ea824d9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367919/normal_604fa6c28220b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464521/normal_60bbd64e51c4a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f791dac0-2fc6-477a-8255-25c953207792/what_kind_of_spark_plug_does_a_briggs_and_stratton.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1129f5a-5517-4a34-8fda-3f93323c1849/16264224064.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b67b97fd-b131-47ef-92d5-f38d04f37d6a/dewalt_dw745_rolling_stand.pdfIn PDF document text
    • http://puzavofan.pbworks.com/f/14738409076.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/399caba3-ff38-486f-a571-82752985611a/eagle_cuda_168_fishfinder_transducer.pdfIn PDF document text
    • http://xosezoranad.pbworks.com/f/poxunesebojupuj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af09eec7-1695-4a88-8ecc-e5c9a37be8ff/vujajafemidofuwibov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d313d4f7-5695-4efc-972e-27a5a930f00a/minecraft_sonoyuncu_makro_indir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0dcdb533-4900-45aa-91d6-1f33660dfff2/annihilation_of_caste_babasaheb_ambedkar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d79b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD79B 5704 bytes
SHA-256: a271b8c6e217908a824306e1665511815947f41d40441df0b0c30e446124005c
font_01_sfnt_off0000eb2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB2C 1772 bytes
SHA-256: 1dee64feb338e2cc595d88a35b766ea8b8b199e124349708576bb4cf11bee47e
font_02_sfnt_off0000f3df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3DF 11304 bytes
SHA-256: b536795d6fb6e329811d609f08c93047b0cc834294351d89c5c2b2f7ae0e197f
font_03_sfnt_off00011ab6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11AB6 16396 bytes
SHA-256: 875449a5d26d970369d8fe3556cda05b18d89b75b97d936b191c807b036b85ce

Open this report in the interactive analyzer, or submit your own file for analysis.