Malicious PDF — malware analysis report

Static analysis result for SHA-256 276cd64793e93a32…

MALICIOUS

PDF

77.4 KB Created: 2021-04-02 03:25:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 266651813d48a64ffe57d1a40fcd9277 SHA-1: 6660c878e4906e570d2700ff9f5201009a968a70 SHA-256: 276cd64793e93a327f8c198eb719543d58cc18b4a09e7f82c40a28c63f69c403
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL pointing to a suspicious domain, and a heuristic indicates it's a lure for a password-protected archive. This suggests the document is part of a phishing or malware distribution scheme. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=super+mario+galaxy+2+guide+book
    • https://static.s123-cdn-static.com/uploads/4413838/normal_5fdd392d6e530.pdf
    • https://static.s123-cdn-static.com/uploads/4408483/normal_5fe526df8c9f8.pdf
    • https://cdn-cms.f-static.net/uploads/4462046/normal_5fe7927a9eab8.pdf
    • https://cdn-cms.f-static.net/uploads/4458421/normal_605cb92499aaf.pdf
    • https://cdn-cms.f-static.net/uploads/4460255/normal_5fd252ed26d7c.pdf
    • https://static.s123-cdn-static.com/uploads/4426080/normal_6000d6e317c43.pdf
    • http://lopitimew.mygamesonline.org/grade_9_math_worksheets_with_answers.pdf
    • https://cdn-cms.f-static.net/uploads/4465397/normal_604e2d0c9cc25.pdf
    • https://cdn-cms.f-static.net/uploads/4368251/normal_600d78b9b4417.pdf
    • https://cdn-cms.f-static.net/uploads/4480174/normal_5fda6ce4ceede.pdf
    • https://cdn-cms.f-static.net/uploads/4421342/normal_5fe89dfb34b7d.pdf
    • http://tuzogat.sportsontheweb.net/19504819862.pdf
    • http://ziwusis.getenjoyment.net/cirrhosis_treatment_guidelines.pdf
    • https://static.s123-cdn-static.com/uploads/4472788/normal_6006bba83cb60.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/62f181ca-a107-463e-bc90-7868164977bf/99820683512.pdf
    • https://uploads.strikinglycdn.com/files/0e58e300-aa47-4ce8-80b2-76bfcc244d58/pistola_airsoft_spring_cybergun_sig_sauer_p226_slide_metal.pdf
    • https://uploads.strikinglycdn.com/files/9cb31d25-e71b-4115-b908-c62ba4e73b97/apa_format_reaction_paper_example.pdf
    • https://uploads.strikinglycdn.com/files/ef876aed-18ba-4ee8-a898-4917e4cb87e2/suunto_vyper_battery_indicator.pdf
    • http://jifisuxevizek.myartsonline.com/4677920268.pdf
    • https://uploads.strikinglycdn.com/files/8cf37f10-06d2-44f7-bdd1-64a8c488dbbf/2004_ford_focus_wagon_reviews.pdf
    • https://uploads.strikinglycdn.com/files/c3ea9856-3164-401b-81e5-5a5e8a6237e8/mojuxu.pdf
    • https://uploads.strikinglycdn.com/files/9ce17391-5ef1-4375-b574-3d1cc65f3a75/how_do_i_find_out_what_year_my_samsung_smart_tv_is.pdf
    • https://uploads.strikinglycdn.com/files/954cdd5d-0993-4b9a-9e57-93b42e9ef46b/74306566762.pdf
    • https://uploads.strikinglycdn.com/files/e82f58d2-9aac-410d-a8c1-5a65ddc80270/86198779230.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f09b.bin
50d93eda21d84dd7360e3a29fd2903f9292bfdc030f776b6a229e4b8e45f9a5b
pdf-font-stream PDF embedded font (sfnt) at offset 0xF09B 5712 bytes
font_01_sfnt_off000103fe.bin
d698c8bb01d2dd79258dcfc64a1baabc518f8269e973abdaa3cf368c975b36d1
pdf-font-stream PDF embedded font (sfnt) at offset 0x103FE 10460 bytes