Malicious PDF — malware analysis report

Static analysis result for SHA-256 16a0d6b028793684…

MALICIOUS

PDF

67.3 KB Created: 2020-12-13 22:54:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 79efe980f0658f7d30e1144bbd5a1097 SHA-1: dfe4e2b474b78b8099acc84e2106de286adf6d7e SHA-256: 16a0d6b0287936844ff0aed74a009840067b4b4ff646638cecdd8581e2788613
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is flagged as malicious by a machine learning classifier and ClamAV, indicating it's a phishing or trojan delivery mechanism. The document body, though heavily obfuscated, contains references to 'Cain and Abel PDF cracker', suggesting a social engineering lure. The embedded URL points to a suspicious domain, likely hosting a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=cain+and+abel+pdf+cracker PDF link annotation
    • https://nefupoxuwuridek.weebly.com/uploads/1/3/4/7/134747690/bokolewamewe.pdfIn PDF document text
    • https://vilukenuxe.weebly.com/uploads/1/3/2/8/132814007/wubigonuja_kafutitudaruj_defelovorojiw_giguge.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc1138816f6d44b07bfcb5c/t/5fc28220cb3e0f5771a136d7/1606582818167/creepy_crawlers_bug_maker_new.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5621e8139af03766314ec/t/5fcc11be7ae85b53b27f375b/1607209411610/us_army_dating_site_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ab8d585-18d0-4cd2-a6a7-f62e9e232371/39509736750.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/chaplin_artist_painter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a47d727-9cd2-416d-b10e-126e7fb2f767/ds_services_standard.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc55a1324b06a7eb31d25e2/t/5fc7466ee2dcb1274dec3b2d/1606895216837/kawaii_wallpaper_cute_kawaii_mignon_instagram.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5cf3ca7e-2aed-489d-b0a2-295ce3638cae/62110548449.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7eb969a0-a2ca-4806-9acc-620e2dc62c95/xotovud.pdfIn PDF document text
    • https://s3.amazonaws.com/mamukawaxatali/salah_bukhatir_quran.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc65fa411f6a41984ab0936/t/5fd0ba2275f5e5048578596c/1607514661289/color_by_number_app_play_store.pdfIn PDF document text
    • https://s3.amazonaws.com/sugaguxagu/55020811116.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c984.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC984 5080 bytes
SHA-256: a5bb0bed33409ab9e31f2973a0f0c899d1b9d94fa9c36446e6e15a21806f27a0
font_01_sfnt_off0000dad8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAD8 11216 bytes
SHA-256: 90c48703e25f573e513093da6a6e7a306ef06e4108cb27994f3cd34c6c5be939

Open this report in the interactive analyzer, or submit your own file for analysis.