Malicious PDF — malware analysis report

Static analysis result for SHA-256 24f3d74b045b6770…

MALICIOUS

PDF

80.2 KB Created: 2021-03-28 15:39:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 892f352f9400310e9e9ace40cd204b2d SHA-1: 91f61c1661c9d64bf30c3f46f51da3f65e28ca4d SHA-256: 24f3d74b045b6770d5c646eea20eef5a8ffd1531d2eb575081b291e8a49ec09c
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains embedded URLs and a heuristic firing for a download button, suggesting an attempt to trick the user into downloading further malicious content. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed for initial access via phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=18+wheels+of+steel+across+america+mods
    • http://wofurasosezisax.mywebcommunity.org/juvugigobokofusuluzo.pdf
    • https://cdn.sqhk.co/wapuvalapowa/mFITUbW/953125671.pdf
    • https://cdn.sqhk.co/madufuxenuw/vhflcjg/adventure_time_simon_abadeer_chapter_2.pdf
    • http://suziterunedoloj.sportsontheweb.net/fadagidawula.pdf
    • http://netekepipavosis.sportsontheweb.net/evinrude_9.9_prop_for_sale.pdf
    • http://mizarofu.22web.org/honda_eb5000_generator_troubleshooting.pdf
    • http://noxitafevinuv.22web.org/associao_brasileira_de_normas_tecnicas.pdf
    • https://cdn.sqhk.co/wibezudak/hgjKigw/free_internet_radio_dance_music.pdf
    • http://lewodazegozi.iblogger.org/adjectives_worksheet_for_grade_3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_0309669bbded4e0f88df4f9d417dee85.pdf?index=true
    • https://s3.amazonaws.com/setaxilitozuko/laretavopawu.pdf
    • http://viniwowosur.onlinewebshop.net/gupujipekidesolenuduxo.pdf
    • https://s3.amazonaws.com/jinabom/my_singing_monsters_wublin_island_guide.pdf
    • http://movasedumanepe.onlinewebshop.net/occupational_safety_and_health_act_2020.pdf
    • https://baad1762-ad72-434c-be9a-9de7d8068d01.filesusr.com/ugd/61395f_effd7c5f488a45e4b98079c2403f62e7.pdf?index=true
    • https://82cb18f6-4a40-4824-ac11-10070f72ce02.filesusr.com/ugd/5aec95_22c666b822954fa5ae679fb8795b82a8.pdf?index=true
    • http://gevalej.epizy.com/xatuxapu.pdf
    • http://fusozevukatamir.atwebpages.com/99490587128.pdf
    • https://s3.amazonaws.com/sajatofubote/dokeduxawewisofuxosemu.pdf
    • https://35057dd6-1d18-4acd-96c9-af3b7fddc7cd.filesusr.com/ugd/978dd5_6f0290f4e6684052be2f40f44d6effbc.pdf?index=true
    • https://s3.amazonaws.com/zesotat/caller_info_app.pdf
    • https://c301b42c-deab-4116-afcd-a09dd0728425.filesusr.com/ugd/4bb894_9c01d7b43ff342aa9ddeb71925d60870.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f46f.bin
72bdfb8b3f108144b4132071fd12e57b12b99b682f5b6045985cfd59f190ef4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF46F 5504 bytes
font_01_sfnt_off00010713.bin
5dfe792b32bc4330a0f84a7ad70f8e9f34b2b976e3228e1b0747a613af277cd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10713 13368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.