Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c88363ed5766d4b…

MALICIOUS

PDF

93.0 KB Created: 2021-03-15 05:17:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0f413740c990b0db64e430dab99caa9b SHA-1: 1e0bb8a038bd2a6b6fed151624c384b66f8a7233 SHA-256: 1c88363ed5766d4bd105a80ec48e1e1287b11dc9d329fdf8ce4ef3ee04f4da8d
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL and heuristic firings indicating it's a phishing lure, likely designed to trick users into downloading a password-protected archive. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=clicker+products+klik2+programming+instructions
    • https://static.s123-cdn-static.com/uploads/4457586/normal_5fcd9eee34a35.pdf
    • https://nobopejulalajib.weebly.com/uploads/1/3/4/6/134621416/bekowijusu_fiwixujik_talulejigopo.pdf
    • http://kitukotobov.medianewsonline.com/kegisexagebijuxurebasujik.pdf
    • https://wuduzavuvavazi.weebly.com/uploads/1/3/4/6/134618101/rawupowujujawa.pdf
    • https://static.s123-cdn-static.com/uploads/4467274/normal_6007cbc33663e.pdf
    • https://static.s123-cdn-static.com/uploads/4462046/normal_5fc7ad5c39a9e.pdf
    • https://rojomitalo.weebly.com/uploads/1/3/4/4/134485393/700878.pdf
    • https://betataniboluwi.weebly.com/uploads/1/3/0/9/130969090/96ff2798b1294f.pdf
    • http://tibijuwubato.iblogger.org/sports_betting_books.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://xofiketur.rf.gd/goxikovokelupuxe.pdf
    • http://dumavibir.rf.gd/50872969846.pdf
    • https://uploads.strikinglycdn.com/files/94a8e48a-cef4-4e8b-903f-15f1eab6438f/yes_please_meals_login.pdf
    • https://uploads.strikinglycdn.com/files/21b37e4c-5ecf-4a9d-a1c9-3921ae2d2f29/14654623094.pdf
    • https://uploads.strikinglycdn.com/files/bd494835-0d94-48e6-8fe8-cbd826538a58/rowobevevikez.pdf
    • http://gupatevefojip.myartsonline.com/manual_de_primeros_auxilios_cruz_roja_colombiana.pdf
    • http://kunaraxanoxun.epizy.com/khmer_math_book_grade_11.pdf
    • http://piwakitidi.onlinewebshop.net/before_we_were_yours_chapter_1_summary.pdf
    • http://vemesivudaro.epizy.com/gemafazirigirasuwefotedi.pdf
    • https://uploads.strikinglycdn.com/files/161b90fd-c3a1-4bd0-bf74-a0e00b0fa734/wozubezazalenilusefeg.pdf
    • http://jagakemiwowinig.epizy.com/govegitigevutadukasuxe.pdf
    • http://zogosugo.onlinewebshop.net/44653114683.pdf
    • http://wurupebolem.rf.gd/company_health_and_safety_policy_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011aff.bin
7a05a489afce97bab2e0d20b69f01b7b5afa9e18db3cb05d9579b550f4bf42bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AFF 5496 bytes
font_01_sfnt_off00012d90.bin
7a62553250e6d61e5226922e267850b2207acc82a18a06c85bb0756ac9c2792f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D90 11780 bytes
font_02_sfnt_off000155e6.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x155E6 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.