Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b5ede9441e6cab7…

MALICIOUS

PDF

314.5 KB Created: 2021-03-17 02:26:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fac191e30c1b11e180a3ff625145d070 SHA-1: d7d85d5a2899e52b473ea00bbb91e52808b95d8c SHA-256: 1b5ede9441e6cab78ff862dc0c99124ef64594d55010556aa754157b111afa4e
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URI that mimics a search result for a vehicle owner's manual, a common lure for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the presence of embedded URLs and the phishing lure heuristic suggest the document is designed to redirect users to malicious sites for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=2003+ford+ranger+fx4+owners+manual
    • http://bimovixexena.scienceontheweb.net/autocad_2020_download.pdf
    • http://kpupnov.pro/4927067513ob6sq.pdf
    • https://sisezapude.weebly.com/uploads/1/3/1/3/131398367/9006453.pdf
    • http://trysol.xyz/391499610282e464.pdf
    • http://trycabinets.xyz/24550765325y43gn.pdf
    • http://academic-club.ru/92647371982ax4qv.pdf
    • http://kurs1.xyz/fituzijogewiy95lw.pdf
    • http://naturebiolog.space/rokejijolelojaropaxamuxuf0k1zn.pdf
    • http://nupesupo.mypressonline.com/dvb-t_usa_frequency.pdf
    • https://wibosopepizasu.weebly.com/uploads/1/3/4/3/134332643/1ba10a1.pdf
    • http://bit7.top/how_to_textual_analysiszue3t.pdf
    • http://myluckywin.site/benujimagim1i41e.pdf
    • http://creditscoretrack.info/vmware_update_manager_source_not_connecteds21rc.pdf
    • http://babysampler.com/pathfinder_tome_of_horrors_complete_downloadidtrw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cfc603e6-7cd4-4c42-812b-9722deb80ae4.filesusr.com/ugd/0e9fc2_7657197a36bd48bda9d730ebf48be76a.pdf?index=true
    • https://s3.amazonaws.com/lupuvogotog/26928196412.pdf
    • https://s3.amazonaws.com/nitatotol/weather_report_ahmadpur_sial_jhang.pdf
    • https://57fc24c6-ba7c-430a-bdae-05304608b610.filesusr.com/ugd/bc9c68_b249b149bec34ec8a4aea9eb83e0ad96.pdf?index=true
    • https://s3.amazonaws.com/legipalofi/zuwapobonu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00048e3b.bin
a49d465e959d823e7aea876b3e4df99d612dedd43b810a9f836542f1dad0ef4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48E3B 4232 bytes
font_01_sfnt_off00049d23.bin
c009b30bbe03f69c08c7a04b6f601bb6180d05079b4d93c91947ef9d72fd86d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49D23 5816 bytes
font_02_sfnt_off0004b0fb.bin
a3dece98c8918a3cd34e576fe3a42a19e36d2cf1d057b2d7e1b7d3900e5a6395		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B0FB 12176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.