Malicious PDF — malware analysis report

Static analysis result for SHA-256 0256981b98724488…

MALICIOUS

PDF

470.1 KB Created: 2021-03-29 11:08:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: e724e59f14bd8143c158149e0512b36a SHA-1: ae84da705213c1d7aa91f57fd0239c47604d8f53 SHA-256: 0256981b9872448839caa7d9410f248aea8b4c6815ffa17534b2bbe4de9b5672
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains multiple embedded URLs, one of which is directly referenced by a heuristic. The ML classifier and ClamAV detection strongly indicate maliciousness. The 'Urgency Lure' heuristic suggests a phishing pretext, and the document body, though heavily obfuscated, contains keywords related to the embedded URL, reinforcing the lure. No scripts were extracted, but the presence of numerous external links points to a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8138

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=tupper+naval+architecture+pdf PDF link annotation
    • http://zootime.store/best_beginners_economics_books1ftam.pdfIn PDF document text
    • http://ig-copyrighthelpcenter.com/apne_movie_watch_online9d0ex.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481400/normal_605d66d91c151.pdfIn PDF document text
    • http://worelimupuvefam.mywebcommunity.org/93764809658.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393020/normal_605b22ce1b28e.pdfIn PDF document text
    • http://loduwij.scienceontheweb.net/41483465772.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445892/normal_60236c63d37ff.pdfIn PDF document text
    • http://beririka.scienceontheweb.net/giwola.pdfIn PDF document text
    • http://mitatizizuje.mypressonline.com/appelle_moi_par_ton_nom_livre.pdfIn PDF document text
    • http://trenolgia.buzz/addie_model_bookf8amj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366007/normal_60542c46c890f.pdfIn PDF document text
    • http://custits.space/87468582039h6k52.pdfIn PDF document text
    • http://dezowem.medianewsonline.com/balasok.pdfIn PDF document text
    • http://figimumagoko.mygamesonline.org/80539260842.pdfIn PDF document text
    • http://idealslim-italiaoficial.site/92159210285nb4oz.pdfIn PDF document text
    • http://nugowimabu.mywebcommunity.org/hello_piano_sheet_music_easy.pdfIn PDF document text
    • http://freshmind.net/shopsmith_scroll_saw_partsbhdo9.pdfIn PDF document text
    • http://kitixukizogutik.mygamesonline.org/ericsson_baseband_5216.pdfIn PDF document text
    • http://funseeds.site/32953511353i8bq.pdfIn PDF document text
    • http://tofoxewesaxizuz.mywebcommunity.org/ahlam_mosteghanemi_the_bridges_of_constantine.pdfIn PDF document text
    • http://sosed.market/95242211109lthvb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bidusibebawuz.onlinewebshop.net/dobuwetijezewo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9bac79e5-bcdb-4aef-b87c-62684118bfc1/95199149035.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/611f2943-bcf1-49ba-b5d2-26047e3be1c2/14861176216.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0006f3df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F3DF 5072 bytes
SHA-256: 55d4d78c6f06ad4418285b49ea7021d813eb088fa96d9d8388346fcf19d7c5ee
font_01_sfnt_off00070523.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70523 13764 bytes
SHA-256: 842b135cd8ca320c29afe1cce0ef3e5eec91b38d0e2d1e1884e256a6dd21b276
font_02_sfnt_off0007321d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7321D 16232 bytes
SHA-256: 518caaef23ff38dffd173390deb2ebbf4fc7588f1930709da0bf1b0df588cfea

Open this report in the interactive analyzer, or submit your own file for analysis.