Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbfaa08af973c2f3…

MALICIOUS

PDF

74.7 KB Created: 2021-04-04 07:45:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc88988eb2d5ce4499d44e4fc8978fd2 SHA-1: b9181b3fa7cf30458750aa1b4c4cb1f90824764b SHA-256: fbfaa08af973c2f3b2a865d58526ea514095a1644853407b35a5109133b00453
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a malicious site. The document body, though heavily obfuscated, contains metadata related to its creation, suggesting it was generated by wkhtmltopdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=5+steps+of+scientific+methodology
    • http://afracheat5.xyz/96665844973nkk9g.pdf
    • http://medtechnika1.ru/los_rios_de_color_purpura_2_online_latinov2jq8.pdf
    • https://static.s123-cdn-static.com/uploads/4445532/normal_5fe0bdeb2a150.pdf
    • https://cdn-cms.f-static.net/uploads/4390663/normal_604a65dbdbdd6.pdf
    • http://fbcopyright-center.com/laxenazopofasidanubaflm8bl.pdf
    • https://cdn-cms.f-static.net/uploads/4453344/normal_602e7a729049f.pdf
    • https://static.s123-cdn-static.com/uploads/4365562/normal_6002464d38bf9.pdf
    • https://cdn-cms.f-static.net/uploads/4393364/normal_605bb3e3b0f5d.pdf
    • https://cdn-cms.f-static.net/uploads/4527237/normal_6060f51111ef1.pdf
    • https://cdn-cms.f-static.net/uploads/4443802/normal_5fe717e43df85.pdf
    • https://cdn-cms.f-static.net/uploads/4449397/normal_60609ad95e31a.pdf
    • https://cdn-cms.f-static.net/uploads/4483097/normal_6018ea0717718.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/53d59a9b-56b3-4ad4-b058-f220f1720359/pajubujulasitemegoruf.pdf
    • http://musotosas.rf.gd/74074017488.pdf
    • http://mimewimirul.rf.gd/software_requirements_specification.pdf
    • https://uploads.strikinglycdn.com/files/ba1ea2d6-f986-44fe-bf12-6a8234835f98/jiwaf.pdf
    • https://uploads.strikinglycdn.com/files/ca7c9bd9-b04a-435a-9562-78912cd1bae8/kuzoxusidemikajina.pdf
    • https://uploads.strikinglycdn.com/files/8a6e27db-baf2-48f2-85cf-f58eab4b9800/99170579186.pdf
    • http://fijosat.epizy.com/jitakiputorinemimas.pdf
    • https://uploads.strikinglycdn.com/files/6b0ae137-7af1-471c-bda2-30f8c7f657ae/harbor_breeze_remote_control_receiver.pdf
    • https://uploads.strikinglycdn.com/files/321b5232-e691-418c-b0e2-25c7c5f1de4b/dimusagatojunori.pdf
    • https://uploads.strikinglycdn.com/files/87421798-3595-40f7-a9bb-a10cb800997b/zezanuxitaxekivi.pdf
    • https://uploads.strikinglycdn.com/files/85aa3822-e84e-49bc-99a8-64b0995b6a41/troy_bilt_pressure_washer_3000_psi.pdf
    • http://vaguwiraji.rf.gd/physical_therapy_aide_job_description.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e789.bin
8a3481594b5fa47b7af0422c115c608407e4f3994d994052349aea9d2cad3dec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE789 5396 bytes
font_01_sfnt_off0000f9d4.bin
489d26641033a57d8d9b7be5bc11e25643fe4ef12b062387e2ed1a3caba8075d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9D4 10452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.