Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe3f57c86193d565…

MALICIOUS

PDF

87.1 KB Created: 2021-03-12 22:14:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 80d3722b24f04e2d6012d2554a789f09 SHA-1: 2c46ca879630ca25238de40edd1477830c7ecce2 SHA-256: fe3f57c86193d5659e2bc3d3ff02f642c6f51d5c41a1645e1206e949382abffc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. The embedded URL `https://pelibifir.ru/aws?utm_term=team+foundation+server+2015+tutorial+pdf` suggests the document is designed to trick users into downloading a malicious payload by posing as a tutorial. No scripts were extracted, but the PDF structure itself contains malicious indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/aws?utm_term=team+foundation+server+2015+tutorial+pdf
    • https://cdn.sqhk.co/malevevipali/Rifhcia/crash_team_racing_online_with_friends.pdf
    • https://cdn-cms.f-static.net/uploads/4457311/normal_5fdaaff62ed42.pdf
    • https://cdn.sqhk.co/zogaxokeno/JNWIahb/zokonibeleniruvepug.pdf
    • https://static.s123-cdn-static.com/uploads/4465905/normal_5ffb80bfe72f4.pdf
    • http://xamojopilupivo.scienceontheweb.net/60653453654.pdf
    • https://cdn.sqhk.co/temejikowewa/ajdD7BG/kubemibesonogeful.pdf
    • https://cdn.sqhk.co/kegufamop/fgi5lhj/92434589931.pdf
    • http://gejokakop.mygamesonline.org/xatosukodabovuxegokiboxi.pdf
    • https://cdn-cms.f-static.net/uploads/4467043/normal_60158b048661a.pdf
    • https://cdn-cms.f-static.net/uploads/4417032/normal_5fd1c1278ee20.pdf
    • https://static.s123-cdn-static.com/uploads/4474978/normal_60090f16c0eb6.pdf
    • https://cdn.sqhk.co/riteximeras/jmtY08W/gedegipudazam.pdf
    • http://<ServerName>:p
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bibejovixapis/96570178471.pdf
    • http://makakanow.onlinewebshop.net/gukupubobafuluw.pdf
    • https://s3.amazonaws.com/piwanisaj/bella_13694_high_power_juice_extractor_reviews.pdf
    • https://uploads.strikinglycdn.com/files/5dee261b-5782-4486-a809-05f7352653af/sibor.pdf
    • https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_16f4392a74bd44ed97bc037268e7cde6.pdf?index=true
    • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_1586563dcc8a443ca001725b6fdc1719.pdf?index=true
    • https://28481333-1ef2-46fb-8ebf-d56c3f24acbc.filesusr.com/ugd/314c35_c9f9605486354fa5b0a10dd4c8d6fd05.pdf?index=true
    • https://315736c7-1030-4200-8d24-05c9f4951019.filesusr.com/ugd/d19ca0_e7a662ceaedf4442ab170f0baef7a6e3.pdf?index=true
    • https://a4346b84-4611-49ab-b113-80c9188ca613.filesusr.com/ugd/078c79_3b08ef1dd6774a7b823d2a9364002d7d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8ce86041-78e8-47dd-a3b4-7090d4e1bb22/kusewularikeguvamafak.pdf
    • http://sogivuwe.onlinewebshop.net/pride_by_dagoberto_gilb_questions_and_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d4f.bin
9fba9b0d9e2cc48f58c52755440c9a9bb3bd4c5dbe3d8c853d7e81cca7fbdf20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D4F 1872 bytes
font_01_sfnt_off00011644.bin
2dda29786946169de43cc6313fdedb712a473b5062ca5cfb06d7b42c618f17af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11644 5644 bytes
font_02_sfnt_off00012971.bin
5d5be87ba71dcf05dd660bff08ca613405226e3c82ea942a0fec4d72960a056a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12971 10920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.