Malicious PDF — malware analysis report

Static analysis result for SHA-256 01a43ced1151a2b5…

MALICIOUS

PDF

247.2 KB Created: 2021-03-28 16:43:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 0b91493ccb5c3741b22cd3fef9a4da70 SHA-1: bd65de7591d5ce58bb7ae7a59e90ca5ef1002b41 SHA-256: 01a43ced1151a2b5b273ccd0126db20e2fb3c258aeff490331736486c50411bc
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The heuristic SE_CALLBACK_LURE strongly suggests a callback phishing or tech-support scam, aiming to trick the user into calling a malicious phone number. The embedded URL https://xezojetit.ru/wix?keyword=huntington+metro+station+parking is likely part of this lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9965

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=huntington+metro+station+parking PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4408177/normal_6046b0a83411e.pdfIn PDF document text
    • http://wozutujetotox.iblogger.org/xomab.pdfIn PDF document text
    • http://gutekixawa.22web.org/how_to_manage_adhd_at_home.pdfIn PDF document text
    • http://taher-tcac.com/xonopuzaxanoxazobodaslbj14.pdfIn PDF document text
    • http://rubeatyshop.xyz/361379641519bpwn.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476421/normal_5fe5d4ef445f2.pdfIn PDF document text
    • http://pe50off.info/dnd_5e_backgrounds_soldiern8op7.pdfIn PDF document text
    • http://findattime.com/annus_mirabilis_poemwkk38.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rixavadalut.rf.gd/bakegefalaniseteduluj.pdfIn PDF document text
    • https://a539eca0-ed6d-4e39-a9fd-63162facd464.filesusr.com/ugd/8170ee_b8b8ded899d84396b8e2dbbec48697ca.pdf?index=trueIn PDF document text
    • http://finezifor.rf.gd/create_color_bitmap_android.pdfIn PDF document text
    • http://baguzakanaso.epizy.com/how_to_open_old_sentry_safe_with_combination.pdfIn PDF document text
    • https://28546a20-d0cc-4b82-bb4f-6711990cd5a3.filesusr.com/ugd/0bcf16_8ad0214bcf7f4419b4ac4f1c18fd08ec.pdf?index=trueIn PDF document text
    • https://c941d99d-b58b-4215-81ce-525e38db2b81.filesusr.com/ugd/2dc4cf_b290025697f945f8a612481b62b8b2e6.pdf?index=trueIn PDF document text
    • https://fa886832-b9e3-4ce5-a98c-97da2614721f.filesusr.com/ugd/9f8050_edea975fd53d4b8f94c18af70a0508f3.pdf?index=trueIn PDF document text
    • http://sawopigemon.epizy.com/worksheetfunction_vba_countif.pdfIn PDF document text
    • http://divupovive.epizy.com/merger_and_acquisition_examples.pdfIn PDF document text
    • https://89511c73-251b-4bee-a1a5-5f4bd4863124.filesusr.com/ugd/f24cb8_b6ce1673d7eb4b2589997ab444a3c06d.pdf?index=trueIn PDF document text
    • http://gofozumi.epizy.com/pink_glitter_in_the_air_sheet_music.pdfIn PDF document text
    • https://722d0b64-886f-48d6-ad1d-3f240095bb95.filesusr.com/ugd/07f6b3_940b138d41c1434eb47d8782421b7a6b.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00039349.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39349 5132 bytes
SHA-256: 7b3b8d5e847de36edc844c1a4bbe1943af8e1cb31a37843cff5d5056a03e31b9
font_01_sfnt_off0003a4ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A4AB 11472 bytes
SHA-256: a71cdd6629064800fecf299333b066e5ea8e83d56ad6fc2f1fcfae225681d4ae

Open this report in the interactive analyzer, or submit your own file for analysis.