Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe2250d16060b387…

MALICIOUS

PDF

83.5 KB Created: 2021-03-22 09:01:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 5d2f68ee46f8708fb5a234be1ad946dc SHA-1: 096b53e3f51d73d00f6e05eb94578bc274cf3558 SHA-256: fe2250d16060b3879d2b146805d3ac6da4a8220c124e7bd66ee024c80cb68b1e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by ClamAV as a phishing trojan and a machine learning classifier assigned a high probability of maliciousness. An embedded URL, https://leonvi.ru/wix?keyword=mee6+commands+list+delete+messages, was found, which is likely used to redirect the user to a phishing site. The document body contains obfuscated data, suggesting an attempt to hide malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=mee6+commands+list+delete+messages PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4409118/normal_60159aa3ea739.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369664/normal_602388493e8b9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367916/normal_6041b8ce71541.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385635/normal_603d71dad57d2.pdfIn PDF document text
    • https://cdn.sqhk.co/wejawujagi/hheE3jb/jixeravomudigomarovo.pdfIn PDF document text
    • http://goods-amzon.com/326465035050g3tz.pdfIn PDF document text
    • https://cdn.sqhk.co/dijabidasu/hfHghuc/gipewabu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417997/normal_6044d130bb1ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369307/normal_6041e3ee455ef.pdfIn PDF document text
    • http://e-devletturkiyeaidatsistemimgovtr.com/mobile_cloud_computing_architectures_algorithms_and_applicationsniauy.pdfIn PDF document text
    • https://cdn.sqhk.co/lunosupi/Ihhijih/xoruzegijagixepenokenaz.pdfIn PDF document text
    • http://rukozhop-guide.com/gapamatoguporagerinoj4lw5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410953/normal_5fd96e8818039.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418764/normal_5ff8480c955c4.pdfIn PDF document text
    • https://cdn.sqhk.co/renapudovi/chj2igh/dragon_spirit_arcade_cabinet.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/56a8dc9d-d1c4-4c21-87fb-69c4eee632c1/download_adobe_premiere_elements_15_full_crack.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6023f2ed-46ab-470c-8893-e1f6a186c312/36505653238.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0106d66-63c6-4175-a6b4-0948db287d78/who_chose_the_books_of_the_bible.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ace3355-efc6-403e-9120-5e2dfe8bc18e/79291421232.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6f1a0f6-90d3-415b-acea-347a68e9b4eb/podadokigirapa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106CA 5324 bytes
SHA-256: fd2c830ef1126dc6bf2204facd73ba93d2b972c9ca0d6b1fa19f75a03749266e
font_01_sfnt_off000118df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118DF 11292 bytes
SHA-256: 03a745ca12bc2c9496b52d1711fb6dd2e49f67c5f3c9e09bdeda40294fa3d361

Open this report in the interactive analyzer, or submit your own file for analysis.