Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a07df571ef14c48…

MALICIOUS

PDF

697.0 KB Created: 2021-03-30 11:14:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 61281971c999ac96c52e1b35628c388f SHA-1: dce96ea35f2789aa29f88c9a1118cbb08565598f SHA-256: 0a07df571ef14c4802a5be47058f9fe1c2cf4d4a5dfd478c3cbbb9cc0c0f06c4
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The document exhibits characteristics of an advance-fee scam, using language related to lotteries and parcel delivery to deceive the user. The presence of multiple external URLs suggests an attempt to redirect the user to malicious content or phishing pages. The ML classifier and ClamAV detection further support the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7782

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=arabidopsis+reference+genome
    • https://cdn.sqhk.co/vibebexez/cFZPc42/basic_bingo_winning_patterns.pdf
    • https://cdn.sqhk.co/gasosivifug/6tvhdbc/lokemebina.pdf
    • https://cdn.sqhk.co/rizonozugaj/bwgKBja/12388244811.pdf
    • https://tutupofu.weebly.com/uploads/1/3/0/9/130968911/diwuwivin-limubukex.pdf
    • https://vevikonupefafo.weebly.com/uploads/1/3/5/3/135391347/c358ee495b7f4f.pdf
    • http://pukebebizadolu.mypressonline.com/12589632300.pdf
    • https://static.s123-cdn-static.com/uploads/4383916/normal_5ff7d25625e83.pdf
    • https://cdn-cms.f-static.net/uploads/4486197/normal_60283b5857b58.pdf
    • https://cdn-cms.f-static.net/uploads/4366339/normal_6054b886508bd.pdf
    • https://static.s123-cdn-static.com/uploads/4371013/normal_5fc99af4de6e6.pdf
    • https://cdn-cms.f-static.net/uploads/4495055/normal_601702f0715fa.pdf
    • http://lomigakorak.getenjoyment.net/pdf_aerodynamics_for_naval_aviators.pdf
    • https://cdn.sqhk.co/madufuxenuw/hXdhahg/minecraft_egg_wars_server_2019.pdf
    • https://cdn-cms.f-static.net/uploads/4419818/normal_60603cae92ae5.pdf
    • https://rajidekexosixi.weebly.com/uploads/1/3/0/7/130738830/455229.pdf
    • https://cdn.sqhk.co/wupifufexix/9k2gioZ/pdf_alcoro_sagrado.pdf
    • https://cdn.sqhk.co/jawosuzexe/iiihehf/93928721679.pdf
    • https://static.s123-cdn-static.com/uploads/4459794/normal_5fdd09a4c74e6.pdf
    • https://cdn-cms.f-static.net/uploads/4408187/normal_6055472158679.pdf
    • https://cdn.sqhk.co/suxidixip/jEkNrI4/91849476297.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000a7315.bin
e23ebb4ac6b04af8cb2a2574d8b18b2a27435f1d86fa0074769cae20047f64d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA7315 5572 bytes
font_01_sfnt_off000a85fb.bin
513c3cb69d71054796ba0f1066a238d09d93e020d566e4141c36103e30d44f83		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA85FB 15124 bytes
font_02_sfnt_off000ab86b.bin
dd46e32939bec78152827fbf5dd898b141184eba991555ec167bf686c016b41c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB86B 16500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.