Malicious PDF — malware analysis report

Static analysis result for SHA-256 049c32870070c7d0…

MALICIOUS

PDF

76.5 KB Created: 2021-06-07 22:42:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 360246b80704645e779a363def704c7b SHA-1: 6a281507aa2b423b060693fabe4e0add443a0d99 SHA-256: 049c32870070c7d0e7864420d25316241d198c8a70fc9b3f6cd4c316b3b09c82
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains an embedded URL that leads to a domain associated with phishing. The document body, though partially corrupted, suggests a lure related to writing a resignation letter, which is a common pretext for phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/pbw?utm_term=how+do+you+write+a+letter+of+resignation+from+an+association PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4389353/normal_60401b177f8b2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453902/normal_601b2894ac57b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409813/normal_604a2ef2df804.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491410/normal_60bd54a402231.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449622/normal_603c43aa16751.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457281/normal_5fca44942854e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366366/normal_60326cf792ff4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381788/normal_6013f2a324df2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449599/normal_602ca870af23d.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4459922/normal_60b5705c27e83.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ede33a5-c3f1-4f48-a98f-1c8ffca403a6/befobutajepeverura.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ada70d1a-21a1-4a62-8bd5-cba648772d80/college_and_career_preparation_1_apex_answers_1.4.3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f31cfab-d132-47aa-a4fa-60b0c4a7a0db/joe_defranco_training_program.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4d9fa24-437f-4e89-8f5d-0dc6098f83cd/keto_recipe_book_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/632f380c-7555-4dc1-9c29-b0d89855f8de/xufuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51c4e123-c97a-414d-b2f9-3675be63cc7a/how_to_draw_eyes_in_simple_way.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/471a90b6-6b78-46b8-9bc7-96dd449378d1/jopixexonokupi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18dda05f-26c6-4c62-85f4-91407a4ce984/zasikuvovil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21661895-6d71-4ed4-807f-9344a69c3183/98531438899.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4e08e7b-e4e7-4478-9d64-784f82681de5/best_gaming_laptop_lenovo_y50-70.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a299b14f-52b5-4c53-8a57-58a3bf68c774/86708129061.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC3F 5496 bytes
SHA-256: d6c3174e6689bcf72756b82fe70763c004db3fec9fa6b1689d07d363d49ba26c
font_01_sfnt_off0000fef6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEF6 11236 bytes
SHA-256: 905a9f4f016a1bfcdb4dcb1cd7e0176e7c6aa8d893bcbe1eb761b99d9f9e1833

Open this report in the interactive analyzer, or submit your own file for analysis.