Malicious PDF — malware analysis report

Static analysis result for SHA-256 10c495e86f0f8a6b…

MALICIOUS

PDF

74.6 KB Created: 2021-04-08 16:40:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f52cd1c2e707fb4875100e2141d55d53 SHA-1: 0e860094a374f72d9289e133bd7fa5fe827fd0d3 SHA-256: 10c495e86f0f8a6b52b07a307ecd282c84112cd80bd699ba67af3f2f39b2dd17
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier. Heuristics indicate it contains a callback phishing phone lure, attempting to trick users into calling a provided number. While no scripts were extracted, the presence of external URIs suggests a potential download or redirection to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=california+citation+lookup
    • http://rte-ita.fun/physics_serway_8th_editionmgnho.pdf
    • https://lifeniwa.weebly.com/uploads/1/3/4/7/134716756/c5371a.pdf
    • http://zokidinodajives.getenjoyment.net/jefit.pdf
    • https://zafaketikeduve.weebly.com/uploads/1/3/4/7/134704309/wetawurusivafifomiro.pdf
    • http://zenajok.medianewsonline.com/favodis.pdf
    • http://svarka-aurora.online/materiales_de_un_panel_solar_caseroue057.pdf
    • http://tuimag.ru/529341992231tn6l.pdf
    • https://pixizibonemitu.weebly.com/uploads/1/3/1/3/131382366/3152670.pdf
    • http://teplotronic.ru/952604452598uiho.pdf
    • http://world-wild-shop.com/chrisfix_buying_a_used_car_checklistwpqch.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jaxunukologefis.onlinewebshop.net/bibliography_download.pdf
    • https://4c80ca50-31de-4e6f-b265-471620011c4a.filesusr.com/ugd/08c6b7_13b14e6fdc3f45d6bf1aaf202a1914c2.pdf?index=true
    • https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_0ad958badcc34e17af2f0ef3bf9006d6.pdf?index=true
    • https://536432c6-7160-4795-b32c-faef63afc1c8.filesusr.com/ugd/5e2347_c17ec1c3ceb442da9cf16d8bf025a863.pdf?index=true
    • http://taberadajip.atwebpages.com/esperanza_rising_book_online_english.pdf
    • https://e055bcc9-c4f1-4c6c-8dcb-0912bf54750f.filesusr.com/ugd/b4a829_00ec8044b2134bd1a3d57f39d292b9a2.pdf?index=true
    • http://jazopizebe.atwebpages.com/fusionner_logiciel_libre.pdf
    • https://e4da1597-3bb3-488b-9226-7c2c9e06e9ce.filesusr.com/ugd/db5d73_0c47d6ef79094b9590866be9f1368a56.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e59b.bin
fbe65a0ebc57ad9dad1ba63f20659508f9683abd33b0a2c94134adf3e6131315		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE59B 4800 bytes
font_01_sfnt_off0000f603.bin
0230b84876500008991a3d40c990e36cb9f71319ef6ff9d371eecb720cf8b68d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF603 11172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.