Malicious PDF — malware analysis report

Static analysis result for SHA-256 00586c6336b0af32…

MALICIOUS

PDF

76.6 KB Created: 2021-04-20 21:00:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c92737cfd4489125c8c2b0b80c633837 SHA-1: e068ce5519a6a9770e6b697a2dca4832dd78395e SHA-256: 00586c6336b0af32cd4230fd37b380bffc7432722a0d1351069b018cc7a3a4b6
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The 'SE_CALLBACK_LURE' heuristic indicates the document prompts the user to call a phone number, consistent with callback phishing or tech-support scams. While no scripts were directly extracted, the presence of embedded URLs suggests a potential for downloading further malicious content or redirecting the user to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+fix+ihome+alarm+clock
    • https://degemojo.weebly.com/uploads/1/3/1/4/131407655/7025835.pdf
    • http://itasda.online/how_is_military_buy_back_calculated75pgw.pdf
    • http://lnstagramcopyrightservices.org/how_to_get_friends_and_influence_others_bookvl4df.pdf
    • http://chambrehq.xyz/how_to_be_an_effective_community_organizer1wao2.pdf
    • http://nomudepalak.medianewsonline.com/himno_al_maestro_salvadoreo_letra.pdf
    • http://pisufixefonof.scienceontheweb.net/breast_cancer_project.pdf
    • https://fekazivijiwawad.weebly.com/uploads/1/3/4/6/134687088/wiwokisegafof.pdf
    • http://ketaton.mywebcommunity.org/navy_special_duty_pay_chart.pdf
    • http://wovoradomumakil.medianewsonline.com/how_to_set_an_armitron_pro_sports_watch.pdf
    • https://xonugovelixef.weebly.com/uploads/1/3/0/7/130739086/7847919.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/0da8bec9-36ae-46f1-bb75-8e424388783a/multivariate_linear_regression_analysis_excel_interpretation.pdf
    • https://s3.amazonaws.com/fedufiporara/33714716757.pdf
    • https://uploads.strikinglycdn.com/files/6f33b46f-b3e4-4b1e-953e-9c6b274694d4/mowexol.pdf
    • http://suxudogakol.myartsonline.com/4311706848.pdf
    • https://uploads.strikinglycdn.com/files/109d1dd3-3c3c-44b1-841b-785a8a478ff0/excel_vba_find_type_mismatch.pdf
    • https://uploads.strikinglycdn.com/files/893fcc64-af7b-4994-af99-3c6c2322523f/omron_e5cn_s.err.pdf
    • http://bejanifezilo.atwebpages.com/renew_australian_passport_application_form.pdf
    • https://s3.amazonaws.com/sojebelevenex/lunebokawub.pdf
    • http://witesenigo.atwebpages.com/dovusobu.pdf
    • https://s3.amazonaws.com/jajuzasalikirut/generate_word_document_from_template_java.pdf
    • https://uploads.strikinglycdn.com/files/1564cfc7-5f5f-4a80-a7f9-bec067f375a0/viluboditemetitudib.pdf
    • https://s3.amazonaws.com/dazemi/adi_shankaracharya_full_movie.pdf
    • http://davinawoguzag.atwebpages.com/sama_veda_samhita.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de27.bin
7e7bb4bdd6f0f1f19a695ffc7e51d27d49fb1f23521d44d465de9683815d6d7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE27 4808 bytes
font_01_sfnt_off0000ee83.bin
c5d6fb1000f49701d1ed62e978b5f9da7e8ed5c3174121d313db0b600eae921f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE83 11492 bytes
font_02_sfnt_off0001154d.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1154D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.