Malicious PDF — malware analysis report

Static analysis result for SHA-256 15a5eb2abd9c42dc…

MALICIOUS

PDF

82.9 KB Created: 2021-03-25 09:23:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eed29be3b915d523672e958892f527f3 SHA-1: d5bcf015f372583c175f4679ac3786847befb7ab SHA-256: 15a5eb2abd9c42dcad761d4df05b48a60a6ec57cd97775643720a23c7708fe4f
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI and a visual download lure suggests a phishing or social engineering attack. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a potential download or redirection to a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=bsava+procedures+manual+pdf
    • http://lanujozawodu.sportsontheweb.net/34454236674.pdf
    • http://tututot.mygamesonline.org/bolts_specification_chart.pdf
    • http://wisatemubudu.medianewsonline.com/what_happened_at_the_overlook_hotel_before_the_shining.pdf
    • https://static.s123-cdn-static.com/uploads/4464739/normal_60032209b5057.pdf
    • http://fibaxoxadomi.sportsontheweb.net/how_to_use_natural_tangents_in_log_table.pdf
    • http://7lessons.space/how_much_is_a_citizen_watch_batteryqs37w.pdf
    • https://cdn-cms.f-static.net/uploads/4491450/normal_6030616157bd8.pdf
    • http://ceter.xyz/lakshmi_narayana_stotram_lyrics_in_telugu46tan.pdf
    • https://static.s123-cdn-static.com/uploads/4401538/normal_5febeded15b98.pdf
    • http://xipevufizokev.iblogger.org/81243547462.pdf
    • https://static.s123-cdn-static.com/uploads/4393502/normal_5ff022050f520.pdf
    • http://lagejarejitog.mypressonline.com/american_english_file_starter_teacher_s_book.pdf
    • http://nakozek.mypressonline.com/how_to_unlock_luxpro_psp511_thermostat.pdf
    • https://cdn-cms.f-static.net/uploads/4500667/normal_6056f2792a22e.pdf
    • http://kovuzaxaf.medianewsonline.com/bomatukapigaginikoxigu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jevelel/13262270629.pdf
    • https://s3.amazonaws.com/jarawaxanivu/pibawewajaw.pdf
    • http://rixibedi.onlinewebshop.net/16287365988.pdf
    • https://s3.amazonaws.com/baxegezivumi/87481468782.pdf
    • http://lesiterifok.epizy.com/bifaboniwosev.pdf
    • https://s3.amazonaws.com/fusidejebi/44121172887.pdf
    • http://zelimasiropaf.epizy.com/software_quality_assurance_interview_questions_and_answers.pdf
    • http://nijorirofebonin.epizy.com/ice_hockey_statistics_sheet.pdf
    • http://fufapawaxuta.rf.gd/les_amours_imaginaires_soundtrack.pdf
    • http://wutejaxevewef.myartsonline.com/tegumeg.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106ea.bin
e211077796f1759cb8f0d6cd6b6ccc6ec94b5062c1788f80dd34671f2c18f0a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106EA 5412 bytes
font_01_sfnt_off00011945.bin
84da1017beac4382ff9425aa96e0b36474c95ba34dc184c98a363094e9d9d7d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11945 10848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.