Malicious PDF — malware analysis report

Static analysis result for SHA-256 22c993446b91130c…

MALICIOUS

PDF

82.7 KB Created: 2021-04-30 09:48:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e3ee1efa34769152ab0761512d80398c SHA-1: 26fcb1f7416f308ba7e6c554ab13c22c8caa81d9 SHA-256: 22c993446b91130c6fe1cfaa6641c9f8d0b1dc1892f8a18bab1b4e40379f5b64
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to a suspicious domain, likely intended to host or deliver a malicious payload. The presence of a 'download button' heuristic further suggests a lure to trick the user into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=mxr+10+band+eq+settings+blues
    • http://smartcreditus.info/sugimokubiladulodirewu0oiif.pdf
    • https://cdn.sqhk.co/tukutabu/4iWhfrI/business_proposal_powerpoint_template_free.pdf
    • https://cdn.sqhk.co/pepigovagove/oyiibpp/68955916103.pdf
    • https://cdn-cms.f-static.net/uploads/4465543/normal_600bbb5b1934e.pdf
    • https://cdn-cms.f-static.net/uploads/4454040/normal_605f5b0fd5eeb.pdf
    • https://cdn-cms.f-static.net/uploads/4455207/normal_5fd979fcd11d2.pdf
    • https://fagugirawax.weebly.com/uploads/1/3/4/3/134388021/7ef55b324234b51.pdf
    • https://cdn.sqhk.co/tevimuwijile/ghiRhdM/come_chiedere_informazioni_in_spagnolo.pdf
    • https://zeruwowigewal.weebly.com/uploads/1/3/0/8/130813736/wiwatapogerurifesefi.pdf
    • https://lonunirixug.weebly.com/uploads/1/3/2/7/132710494/7708879.pdf
    • https://cdn-cms.f-static.net/uploads/4365602/normal_601b1cf4f2b58.pdf
    • https://vegujuzemev.weebly.com/uploads/1/3/4/0/134017506/8a86766ad2a32.pdf
    • http://doctorzlo.com/togujidegalisuj5y9gq.pdf
    • http://mmeueue.space/609743959546w55l.pdf
    • https://peliretoru.weebly.com/uploads/1/3/3/9/133997281/fivejijawi.pdf
    • http://profit-makers.club/kaviw1hp88.pdf
    • http://natlab.ru/mojolafsxn2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/72b28bb5-b705-4165-ad41-ba051035d1d5/2008_nissan_sentra_service_engine_soon_light.pdf
    • https://cd8fad78-6a19-43c6-878c-830d169ee42d.filesusr.com/ugd/ff0d91_b71b3c86e4ee4a6ebb72d05bb2711c50.pdf?index=true
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_1739a6d261f747279502883e066629fb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/98410357-27ec-4fe4-8d40-78cbaeaf6828/11466875330.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6b9.bin
c11a4500c28de54ccb81c22a7cc99aa8ca75dbf3bfc00731e68d35e02198b00e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6B9 5296 bytes
font_01_sfnt_off000108be.bin
d00d62bc5a84196cfd4c32a63cb5913d3c4f5f4e749f303a198024ab0240a926		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108BE 11412 bytes
font_02_sfnt_off00012f8c.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F8C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.