Malicious PDF — malware analysis report

Static analysis result for SHA-256 23c7f306f9cb26b8…

MALICIOUS

PDF

75.6 KB Created: 2021-05-11 06:24:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 2c5a005742fb93b8cfa31a788e1c3237 SHA-1: d39f4d208bc1e3774db508844052332ad749c577 SHA-256: 23c7f306f9cb26b8fed8d433edbb9ff260bc29076e0b5a4e3056ac9dfebedcd1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document body, though partially corrupted, contains text related to 'p.s na carta' and mentions 'wkhtmltopdf', suggesting a lure. The presence of multiple unknown reputation URLs, including 'https://maypoin.ru/strik', strongly indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=o+que+significa+p.s+na+carta PDF link annotation
    • http://cosmeteca.com/zufamumezoxiwifaxeromewiov3cy.pdfIn PDF document text
    • http://sallles.ru/asma_ul_husna_malayalam_meaning61dlt.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462681/normal_602f19a5c9505.pdfIn PDF document text
    • http://taher-tcac.com/how_to_check_on_a_company_with_the_bbbvxdd5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369522/normal_60349bc7d102a.pdfIn PDF document text
    • http://detonic-ufficiale.website/tap_tap_gun_all_gunsqqwza.pdfIn PDF document text
    • http://itprod.space/sebik51xuh.pdfIn PDF document text
    • http://prodson.fun/87898491359vgc44.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488556/normal_5fe062270df81.pdfIn PDF document text
    • http://beautysale.site/vanazudijaropash6h.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475563/normal_6047213594300.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/besafefaf/acceptable_forms_of_id_uk_alcohol.pdfIn PDF document text
    • https://s3.amazonaws.com/fadobirak/38486269684.pdfIn PDF document text
    • https://s3.amazonaws.com/tevomenil/5249984764.pdfIn PDF document text
    • https://s3.amazonaws.com/gewuwasi/how_to_find_the_volume_of_a_graduated_cylinder.pdfIn PDF document text
    • https://s3.amazonaws.com/baxunaf/why_is_my_fire_detector_beeping.pdfIn PDF document text
    • https://s3.amazonaws.com/jusagi/16770823080.pdfIn PDF document text
    • https://s3.amazonaws.com/sefepugolupalax/online_preposition_test_for_class_3.pdfIn PDF document text
    • https://s3.amazonaws.com/kotidox/the_highwaymen_movie_cast.pdfIn PDF document text
    • https://s3.amazonaws.com/zuguvoxoki/24884369067.pdfIn PDF document text
    • https://s3.amazonaws.com/tokafanawa/1431387092.pdfIn PDF document text
    • https://s3.amazonaws.com/waxapoz/android_metronome_tap_function.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8A9 5336 bytes
SHA-256: 21e6b492f07934e15e02729fba238967c85473eaf08fc16de3dad6f5f104e591
font_01_sfnt_off0000faef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAEF 11172 bytes
SHA-256: 30d94e0226fb29834849c951ef6f5c824b4f4917e8b4e52e468537aa6b950fd6

Open this report in the interactive analyzer, or submit your own file for analysis.