Malicious PDF — malware analysis report

Static analysis result for SHA-256 236cd8224262189e…

MALICIOUS

PDF

78.5 KB Created: 2021-03-09 17:42:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 652f0017d65bf896fb909d8ecfefee01 SHA-1: 004fe0299ad084cde492534c95d9a76bed961af9 SHA-256: 236cd8224262189e89b46a792d04aede29e54be76e6d134ca1cd1bfc0fefd321
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'fokemale.ru', which is likely a phishing or malware distribution domain. The presence of a 'download button' heuristic further supports the lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=haloalkanes+and+haloarenes+neet+notes+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4393635/normal_5fe73fe7b51bf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484358/normal_5fddb10a3ea3e.pdfIn PDF document text
    • http://sallles.ru/lipinunipodibasoji999.pdfIn PDF document text
    • http://cardio-natural.info/zafumozomawtqix.pdfIn PDF document text
    • http://uorott.com/91385523435slj9l.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421615/normal_5ff5abf36b4b0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451940/normal_6035fbc95ada4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384145/normal_602c04bcf37ab.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405202/normal_5fdf0f7a9b9b5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470391/normal_6009659ba141a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402944/normal_600d356c05fa8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/acb78427-0b66-41d6-9de2-d7d2335c5cd3/how_to_write_lambda_in_latex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70704fad-52fd-438f-97d7-0d08f3ffea69/pobimi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/159738ca-c313-4a5e-8dd3-6454bc585bdb/whirlpool_conquest_refrigerator_water_dispenser_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2721dfe5-1a95-4c13-8eb9-95a9cf28479d/iomega_home_media_network_hard_drive_firmware_2.104.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de96a890-4ae2-493b-97ee-50375642ca4e/to_train_up_a_child_by_michael_and_debi_pearl.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b396dc9d-e914-4333-b130-79ca26167322/7419164099.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5ba7f7c-3b2c-467e-9a4b-10caf8a95573/how_to_mix_auto_paint_colors.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c997fc24-2b39-4d72-a306-83728da823e9/94174869558.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68fc18b9-7b28-48ad-884b-3593c55af37d/rurupemexewapotogogisanux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40be41a6-d8a5-434c-80ff-c3babfcccac0/sakinelifof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1b5c0e3-fef9-48a2-ae53-1a21cb6c29d1/how_to_make_origami_heart_step_by_step_instructions.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7AF 5152 bytes
SHA-256: 38ad93df5c3b79048e413c86eb868326c332dba4ddd228f3be85b29fb329bd27
font_01_sfnt_off00010927.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10927 10228 bytes
SHA-256: 130e768c89b15028117dfc01a353b75eccdc2cc7509af7f4e71a94e4b3fbad33

Open this report in the interactive analyzer, or submit your own file for analysis.