Malicious PDF — malware analysis report

Static analysis result for SHA-256 1317e703655ac8c6…

MALICIOUS

PDF

83.2 KB Created: 2021-04-04 01:33:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 57278a458d8a6ecb752f91bcb9a4d117 SHA-1: d6bb6c8c6b2b64d373033671f4365ce99c243a7f SHA-256: 1317e703655ac8c6f7d18941aa20793321b48f140e8a19c418f145f093a34a52
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of external URIs, specifically one pointing to 'vilenefex.ru', suggests the document is designed to redirect users to potentially harmful content or downloads. The 'SE_DOWNLOAD_BUTTON' heuristic further supports the idea that the document is attempting to trick the user into initiating a download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=gta+5+apk+and+data
    • http://eurozone.pro/top_ringtones_2019_download_pagalworld._comudfvc.pdf
    • https://cdn-cms.f-static.net/uploads/4458826/normal_604680212d38e.pdf
    • http://keluzizizeroki.getenjoyment.net/introduction_to_mathematical_thinking_book.pdf
    • https://lirodute.weebly.com/uploads/1/3/1/8/131871659/1819888.pdf
    • http://sosogemizibu.mypressonline.com/57800493925.pdf
    • https://wuwotozon.weebly.com/uploads/1/3/4/3/134315251/titodor-luzuzuk.pdf
    • https://cdn-cms.f-static.net/uploads/4453885/normal_6066361ef248e.pdf
    • http://jazejoravasog.22web.org/guidelines_pulmonary_embolism.pdf
    • http://storeeu.info/how_to_use_hans_3dsyzk4i.pdf
    • https://jixatazibasuv.weebly.com/uploads/1/3/4/4/134402985/wukep-pavaji-sexusumu.pdf
    • http://znohist.site/71418027700njrr0.pdf
    • https://zuwanefo.weebly.com/uploads/1/3/4/0/134040462/dobetu_jumelofekut.pdf
    • http://zetumitufam.mywebcommunity.org/libididegufarowujelewi.pdf
    • https://static.s123-cdn-static.com/uploads/4403936/normal_5fe214c1a52da.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zitoveruvet.epizy.com/7326083081.pdf
    • http://giraxajo.epizy.com/casida_book.pdf
    • http://risatimax.rf.gd/restricted_license_test_guide_nzta.pdf
    • https://56076a71-1b70-41e8-afe1-d547c394b4ee.filesusr.com/ugd/ab0d05_9473a179c87c45e89bc05d29b5d876a3.pdf?index=true
    • http://zaberosem.rf.gd/7490327571.pdf
    • https://6d706a39-1f93-4f1a-9423-caccf7e65e71.filesusr.com/ugd/69f91f_41589aaeb54d470cb80c20daa18460d2.pdf?index=true
    • http://bipegokatif.onlinewebshop.net/sonda_vesical_pediatrica.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fce6.bin
38666a8d295ba68241f01b0f86088cc30be4cb2c80248a5832f9470df7eb979a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCE6 4380 bytes
font_01_sfnt_off00010bd4.bin
31d3dcada610b1c1bdb22b49cb950a654875d8953cc9d7ac9ac1eb87ed16a744		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BD4 11088 bytes
font_02_sfnt_off000131a3.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131A3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.