Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdff70ffe36bd682…

MALICIOUS

PDF

107.4 KB Created: 2021-03-27 22:28:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d8597b498bd239642ce68fbd3201e1b7 SHA-1: 19ee8126dbb2411eef4474b880a303365b5bb069 SHA-256: fdff70ffe36bd682dbd30a2aca6df4a626574312b01e70408333023116c49adb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a website disguised as a product review. This URL is likely used to host a phishing page or download further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/aws?utm_term=delta+table+saw+36-725+review
    • https://pisixaxonazav.weebly.com/uploads/1/3/5/3/135394173/2583299.pdf
    • http://sdl-trade.com/kumijosesumeriwese5abtf.pdf
    • http://x-bionic.shop/is_it_healthy_to_eat_dinner_earlymn2b6.pdf
    • https://cdn-cms.f-static.net/uploads/4445736/normal_6025f22fa7c39.pdf
    • http://lnstagram-verifedbadge.com/how_to_use_a_keurig_mini_youtube93k2z.pdf
    • https://sekikeke.weebly.com/uploads/1/3/4/7/134739811/nuromenodijunizevi.pdf
    • https://static.s123-cdn-static.com/uploads/4487916/normal_600495bfa86fe.pdf
    • https://vuxupiwiruxip.weebly.com/uploads/1/3/0/9/130969000/pukobejexi.pdf
    • https://cdn-cms.f-static.net/uploads/4485010/normal_600f8ca5a00ab.pdf
    • http://juilopkiretlo.ru/ashland_or_weather_reportmo6y5.pdf
    • https://pixasowurixes.weebly.com/uploads/1/3/4/9/134904492/7237e407421b.pdf
    • http://idealicaitaly-ufficiale.site/categorical_versus_numerical_datawrec8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/badodemebo/32233331663.pdf
    • https://s3.amazonaws.com/nowokil/mabibisejefi.pdf
    • https://uploads.strikinglycdn.com/files/b1b5761c-470e-4d6d-9655-e672b79e9a3f/yard_machine_snow_blower_4.5_hp_21.pdf
    • https://b5f169ef-6bcf-4d19-a24b-32bdc9dd7a5f.filesusr.com/ugd/2e79a6_44e23565a9bd4f76962df9eda37811ae.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e6f88315-5751-4501-a604-25ee2e110270/how_to_use_log_table_in_hindi.pdf
    • https://s3.amazonaws.com/fobupojowojon/nitecore_d2_intelligent.pdf
    • https://uploads.strikinglycdn.com/files/6324e765-8803-46bb-983f-9fa12e25b69a/how_to_add_buttons_to_header_wix.pdf
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_061982bbefea4882891cad746ce066fb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3c591ff8-ccc1-40b0-88da-e96dd3187e0e/criminal_defense_attorneys_in_houston_texas.pdf
    • https://s3.amazonaws.com/wizomoravazub/agriculture_website_templates_free_psd.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013f5b.bin
eb2839dbc4a2397681e06167caa7419485bded881e4386d5999c7ec310fc31a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F5B 5228 bytes
font_01_sfnt_off0001514f.bin
e2185b7b166045a2ac77eaf47f26dc9040b3cab34ac5ee993b5467478801ea52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1514F 12296 bytes
font_02_sfnt_off00017b25.bin
541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17B25 16204 bytes
font_03_sfnt_off00019053.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19053 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.