Malicious PDF — malware analysis report

Static analysis result for SHA-256 15f455c26cc857c2…

MALICIOUS

PDF

71.8 KB Created: 2020-04-24 04:05:05 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 04cff454c26042f16873b757e2cec0df SHA-1: 5428cbe34bb3bdbf9b088632dd97bf81968cf80c SHA-256: 15f455c26cc857c293ff9bc4e27d7c31ac3c60d5f7fe0e6aed841f8e93e768ec
76 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier and the 'Advance-fee Scam Lure' heuristic strongly indicate a malicious intent. The document's content and embedded URLs suggest a phishing attempt designed to trick users into paying fees for non-existent prizes or parcels. No scripts were extracted, limiting the analysis to the document's structure and embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9823

Heuristics 4

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kimresine.ca/uploads/1/3/0/2/130287238/130287238.html#rcog+guidelines+gestational+diabetes+screening
    • http://choosesafe.com/uploads/1/3/0/3/130379193/zugim_supanaz_fajavoge.pdf
    • http://travel-taste-explore.com/uploads/1/3/0/6/130604427/33c0655de.pdf
    • http://orangecovesda.com/uploads/1/3/0/6/130621228/1744d5089.pdf
    • http://stargazingangel.com/uploads/1/3/1/3/131380351/fitini.pdf
    • http://swangraphicsbysrm.com/uploads/1/3/1/3/131380258/3d28129f49e.pdf
    • http://goo.6Page
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8bf.bin
661587f4fe0b877418e0764213621702340867a9ed4c0e130373e8cd93eefa50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8BF 9856 bytes
font_01_sfnt_off0000fc63.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC63 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.