Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd7c84685c331b1d…

MALICIOUS

PDF

94.9 KB Created: 2021-04-23 03:55:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5a91039cb0817fb3af10c8de45f52039 SHA-1: b80ea15dc2cf2f8c9519655c2c56be35e51b545b SHA-256: fd7c84685c331b1da0da409edc4ddd1d7d1536e6e527c9c2375d8555de78d735
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified by heuristics and ClamAV as malicious. The document body, though heavily obfuscated, appears to be related to a 'how to change battery' query, suggesting a lure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution via the embedded URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+change+battery+marantec+remote
    • https://cdn.sqhk.co/kabolode/GzhighC/hudson_park_sheets.pdf
    • https://kodavagimiwebod.weebly.com/uploads/1/3/5/3/135346487/8002162.pdf
    • https://nukivobiwej.weebly.com/uploads/1/3/4/0/134016752/jomibala.pdf
    • https://cdn-cms.f-static.net/uploads/4408987/normal_5fd36cacab070.pdf
    • https://cdn.sqhk.co/bogovureg/gVhbigr/30792142624.pdf
    • https://cdn.sqhk.co/rujuwawuju/jcRiegi/facebook_marketplace_central_nj.pdf
    • https://cdn.sqhk.co/doxurozupu/YHS4qgP/faith_family_academy_calendar_2020.pdf
    • https://jigupipugefelo.weebly.com/uploads/1/3/4/3/134387822/6113572.pdf
    • https://cdn-cms.f-static.net/uploads/4418778/normal_6015bab030567.pdf
    • https://cdn-cms.f-static.net/uploads/4443598/normal_60119d2d18537.pdf
    • https://cdn-cms.f-static.net/uploads/4422914/normal_5fe98f6e87c70.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dajurelelerasak.rf.gd/putaxumosupavaweliwa.pdf
    • https://uploads.strikinglycdn.com/files/2aef5540-84c1-453b-a747-9da176511b0c/elder_scrolls_online_breton_mage_build.pdf
    • https://s3.amazonaws.com/tugumeb/bergey_s_manual_pseudomonas_aeruginosa.pdf
    • https://uploads.strikinglycdn.com/files/e23db6c9-b5e8-4752-8268-feeceed7e52f/majumetipibubojodirudeg.pdf
    • http://sadamenukovizep.epizy.com/bharti_axa_life_elite_advantage.pdf
    • https://uploads.strikinglycdn.com/files/b787f171-5267-4114-9aa0-349cf415a524/dns-323_firmware_1.09_download.pdf
    • http://jijawidifopaw.epizy.com/adverbial_openers_ks2_worksheet.pdf
    • https://s3.amazonaws.com/dotivaf/wuzokorasutugeden.pdf
    • https://uploads.strikinglycdn.com/files/bb19aecc-b7f0-46ae-b31a-f475e7a6dc1a/ledikizosesokapogori.pdf
    • https://uploads.strikinglycdn.com/files/9d09d154-fbb2-483f-8931-bd0acc3d50ba/puxiguwogadoxibe.pdf
    • https://s3.amazonaws.com/baposivarabuj/soditexuvasupokekiruxamu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000136c1.bin
97b309e4a75f31061003f8f2431a9843b1a492186d334971136d5ccb2ef30517		 pdf-font-stream PDF embedded font (sfnt) at offset 0x136C1 5296 bytes
font_01_sfnt_off000148b9.bin
ae8af8387f0d281a7d6560f80b285ad68de1d88b8496259d42bfad801e1d74d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x148B9 11012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.