Malicious PDF — malware analysis report

Static analysis result for SHA-256 0937ddc3b7b37dca…

MALICIOUS

PDF

73.6 KB Created: 2021-02-27 16:28:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18c15052b20d30d0fa13c65783cbf0b4 SHA-1: 106d3395521d9928d15f5994a183c142504e2cf9 SHA-256: 0937ddc3b7b37dca59b6479b429597da2bde9e293b2a57a755f248ff6db2f296
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was flagged by a machine learning classifier and ClamAV as a malicious PDF, specifically identified as a phishing trojan. The heuristic 'SE_CALLBACK_LURE' indicates the document's content is designed to prompt the user to make a phone call, consistent with callback phishing or tech-support scams. While no scripts were explicitly extracted, the presence of external URIs suggests the document may attempt to download additional malicious content or redirect the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=www.ebrschools.org+quick+links
    • http://vizexibidoxi.getenjoyment.net/36812868177.pdf
    • http://sallehq.xyz/how_to_freestyle_rap_lyricsabqdu.pdf
    • http://flowerport.market/85404804670wqzgn.pdf
    • https://cdn.sqhk.co/vexorikodo/A3Cjfjg/english_reading_comprehension_practice_exams.pdf
    • https://cdn.sqhk.co/zukuxenopo/hhEuhel/5103416388.pdf
    • http://feelslike35.com/ninja_professional_plus_blender_with_auto-iq_reviews8961u.pdf
    • https://cdn.sqhk.co/fajaleniwa/hfhbhdJ/siwifisuj.pdf
    • http://kejoxemubogese.mywebcommunity.org/maytag_model_mvwx655dw1_problems.pdf
    • https://cdn.sqhk.co/limiwebu/jbFzja0/gijaril.pdf
    • http://jiteruruw.sportsontheweb.net/76150862535.pdf
    • https://ebrschools.org/quick-links/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nademopor/coordinate_plane_blank.pdf
    • http://zesafemumibow.myartsonline.com/96878665451.pdf
    • http://wutejaxevewef.myartsonline.com/what_do_the_letters_mean_in_the_16_personality_test.pdf
    • https://s3.amazonaws.com/legapatatezisa/92402868918.pdf
    • https://s3.amazonaws.com/fajixe/betifepifojadifowosejup.pdf
    • https://s3.amazonaws.com/kosipefojaw/que_funcion_cumple_las_papilas_filiformes.pdf
    • https://s3.amazonaws.com/viromibukoleliw/36108556434.pdf
    • http://forezepolutaju.onlinewebshop.net/mental_toughness_navy_seals.pdf
    • http://dufojamimusim.atwebpages.com/dasiwifixusokuwu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e262.bin
ecd3ed013da0fcb5f10d7eef65bb728f3ed73d9eafa158ed578b683e22bd486b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE262 5316 bytes
font_01_sfnt_off0000f499.bin
20dceaf6166dbb74f39e26ffadc05c7ea097feccfb0e301898cd9bfb5a4b919e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF499 10748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.