Malicious PDF — malware analysis report

Static analysis result for SHA-256 097107348e2cbac6…

MALICIOUS

PDF

72.9 KB Created: 2021-04-05 14:56:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: cec2f334cc498c708f39185c0ff5bf2b SHA-1: f1691f77a0e616ae216436a0077988b8d26d19f9 SHA-256: 097107348e2cbac690fca140c02da2f23b511c75da7233f862f8daa4429fffcc
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that is flagged as malicious and associated with phishing. The 'SE_CALLBACK_LURE' heuristic indicates the document is designed to trick users into calling a number, often related to billing or security scams. While no scripts were explicitly extracted, the ML classifier and ClamAV detection strongly suggest malicious intent, likely involving a phishing or trojan payload delivered via the embedded URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=elementary+information+security+2nd+edition+pdf+free+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4369163/normal_5fe3893b9e235.pdfIn PDF document text
    • http://lighterusb24.site/quadra_fire_mount_vernon_pellet_stove_partsz0a5x.pdfIn PDF document text
    • http://gratoraama.website/disuniwon21d.pdfIn PDF document text
    • http://repair-kvadrokopterov.ru/saresabitafarikekovesp6wpz.pdfIn PDF document text
    • http://viwimewi.22web.org/64775716205.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369638/normal_5fd0f69b503ad.pdfIn PDF document text
    • http://pedagodogiko.getenjoyment.net/sanafizolidalojavoju.pdfIn PDF document text
    • http://winoraama.fun/pnb_rock_album_download40xyj.pdfIn PDF document text
    • http://ziximotizaned.medianewsonline.com/bowflex_pr1000_home_gym_for_sale_used.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fuzuwami.epizy.com/gcse_maths_past_papers_with_answers_edexcel.pdfIn PDF document text
    • https://s3.amazonaws.com/roxawo/mowonotipunatebokofu.pdfIn PDF document text
    • https://s3.amazonaws.com/wutisigila/insinkerator_garbage_disposal_weight.pdfIn PDF document text
    • https://s3.amazonaws.com/bifamomove/56344013746.pdfIn PDF document text
    • https://s3.amazonaws.com/dorulusof/91153754431.pdfIn PDF document text
    • http://rawigukegopafot.onlinewebshop.net/kuxafurorameg.pdfIn PDF document text
    • https://s3.amazonaws.com/tojabixefova/how_to_become_a_certified_small_engine_technician.pdfIn PDF document text
    • http://wodasakuzetu.rf.gd/bollywood_video_songs_mkv_free.pdfIn PDF document text
    • http://turekepopede.rf.gd/60283739865.pdfIn PDF document text
    • https://s3.amazonaws.com/marimejerebo/pulse_secure_vpn_client.pdfIn PDF document text
    • http://bujegijuv.rf.gd/unix_sed_and_awk_tutorial.pdfIn PDF document text
    • https://s3.amazonaws.com/zetituri/dawuv.pdfIn PDF document text
    • https://s3.amazonaws.com/moduxanakuri/tusemodafujamobo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ddd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDD3 5584 bytes
SHA-256: 1836e4b57237abc2c0e6869424aedb3958aea0fc299873f1c1d37dffa5318824
font_01_sfnt_off0000f0dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0DC 11048 bytes
SHA-256: 4f654d87651ca833646a8e62c901ff1374622cf8ac544f02931bab4392467886

Open this report in the interactive analyzer, or submit your own file for analysis.