Malicious PDF — malware analysis report

Static analysis result for SHA-256 261bc81f529ff4a5…

MALICIOUS

PDF

76.1 KB Created: 2021-03-06 23:27:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f3956a508aa182a4a863c0ba4b010a65 SHA-1: 826b338dee5788e704baa79a41ced80013910028 SHA-256: 261bc81f529ff4a541e75435aa51fee553567da6bfdd667f8442f1c20b730ee9
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing or trojan. The document body, though heavily obfuscated, contains text related to fixing a 'shift key not working' and includes an external URI pointing to a URL that also mentions 'how to fix shift key not working'. This suggests a lure to trick the user into clicking the link, likely to download a secondary payload or redirect to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+fix+shift+key+not+working
    • https://cdn.sqhk.co/bipozipo/Dhcy9jd/80840465146.pdf
    • http://tegokujili.iblogger.org/43958005621.pdf
    • http://kirakexig.mypressonline.com/attack_on_titan_season_4_episode_1_overview.pdf
    • https://cdn.sqhk.co/supesuvepo/7hgeiaT/xisafazunowe.pdf
    • http://zoguponuwuxoli.medianewsonline.com/can_an_employer_terminate_you_during_covid.pdf
    • https://cdn.sqhk.co/zifeduwa/HiiL6ig/vugosu.pdf
    • https://cdn.sqhk.co/bujasugawo/5dzDdie/other_names_for_dog_sitter.pdf
    • https://cdn.sqhk.co/juvebuzizej/jCE9hMH/duvibusuvorunuwere.pdf
    • https://cdn.sqhk.co/jupozaregu/dr5exAp/xcom_2_avenger_build.pdf
    • https://cdn.sqhk.co/nukusigemug/jyznjig/knight_rider_2008_movie.pdf
    • https://cdn.sqhk.co/ramazunor/gjgijNr/all_star_logo_dream_league_soccer.pdf
    • http://jologedeb.getenjoyment.net/who_makes_runts_candy.pdf
    • http://perudewoketusam.iblogger.org/samsung_srd_1653d_default_password.pdf
    • https://cdn.sqhk.co/zoxunoromi/7oPgeji/kazigebo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zijiwaras.onlinewebshop.net/acer_aspire_e5-571_price_in_pakistan.pdf
    • http://gubadix.epizy.com/39932998810.pdf
    • http://kaforezut.epizy.com/12188723511.pdf
    • http://bodirinukamole.onlinewebshop.net/wejajepozora.pdf
    • http://wekidezeze.epizy.com/best_online_drawing_classes_reddit.pdf
    • http://xewenofos.epizy.com/42543264924.pdf
    • http://nupakavidowux.epizy.com/igloo_ice103_manual.pdf
    • http://fizatagaregig.rf.gd/ropawuwigif.pdf
    • http://kakoxiji.rf.gd/motorola_mc5574_manual.pdf
    • http://zixadadafupeg.epizy.com/latest_update_of_whatsapp_apk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed9f.bin
d29c50c1dab29e0a1e746b03cbaf4fde0a7fa8caa8e9bf8b9b0118c0c71a9655		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED9F 5072 bytes
font_01_sfnt_off0000fefd.bin
864f7de3d8978e82934c0243c26598f63993473bf24f673357d925889b5ac8bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEFD 10544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.