Malicious PDF — malware analysis report

Static analysis result for SHA-256 18ffb5d486748158…

MALICIOUS

PDF

78.5 KB Created: 2021-04-25 09:26:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7988f7bd149ed5d114f540bc968d62d6 SHA-1: 742f6a48379bbd80498a027eca8e13af75924928 SHA-256: 18ffb5d486748158c78eecd605ca62e54c22e4a85c62697328d5e83b2e165af6
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a lure for a course completion certificate, which is a common social engineering tactic. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document is designed to trick users into opening a password-protected archive, likely containing a malicious payload. The embedded URL points to a domain associated with phishing, and ClamAV detection confirms its malicious nature. No scripts were extracted, but the overall pattern suggests a phishing attempt designed to deliver a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=aprendizajes+clave+curso+imprimir+constancia
    • https://cdn-cms.f-static.net/uploads/4471252/normal_5fdb8dc5d0355.pdf
    • https://cdn.sqhk.co/tigufarejeti/UVbBiaf/vintage_snake_belt_buckle.pdf
    • https://cdn-cms.f-static.net/uploads/4455673/normal_6052016117908.pdf
    • https://cdn.sqhk.co/dagufiwus/a0hfhb6/bedul.pdf
    • https://cdn.sqhk.co/bagudivibi/iajfjfE/pugetulonojelun.pdf
    • https://cdn.sqhk.co/letarezetap/jjgcjiX/bluestacks_hd_app_player.pdf
    • https://cdn.sqhk.co/gokarunedod/GheXF49/nail_cutting_tool_kit.pdf
    • https://cdn-cms.f-static.net/uploads/4484364/normal_60137270dc067.pdf
    • https://cdn.sqhk.co/bopesajan/geZjjdK/my_mtn_account_is_suspended.pdf
    • https://cdn-cms.f-static.net/uploads/4454426/normal_601efc6276323.pdf
    • https://cdn.sqhk.co/muligumixe/highdgh/demawopiduvod.pdf
    • https://cdn.sqhk.co/datagemop/ijghwcM/clock_countdown_timer_candle.pdf
    • https://cdn-cms.f-static.net/uploads/4412902/normal_606e8ec283c7d.pdf
    • https://cdn-cms.f-static.net/uploads/4455377/normal_6011d29b75784.pdf
    • https://cdn-cms.f-static.net/uploads/4477386/normal_603b359ce7fdc.pdf
    • https://cdn.sqhk.co/neliwuwo/ajaKYie/54569006406.pdf
    • https://cdn.sqhk.co/juzosugun/i2hygcD/46789732883.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sepusuvom.epizy.com/zipeke.pdf
    • http://nozixexegaliwe.rf.gd/what_is_the_difference_between_descriptive_and_inferential_questions.pdf
    • http://mebakedunibujag.rf.gd/jvc_camcorder_battery_bn-v20u.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e570.bin
d8b907802410e675ceca2784509e58a9dae2947c1b2ad43e3e0c02687eabed47		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE570 2952 bytes
font_01_sfnt_off0000effe.bin
28189ba497349f488c103125933c46421cc0a2dc6d51da137b8d5ec6b0ba482e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFFE 5392 bytes
font_02_sfnt_off00010255.bin
8697ff8189c36ac18feae729cbae4488922a7832bc8b8029d2531e31b8774be3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10255 12120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.