Malicious PDF — malware analysis report

Static analysis result for SHA-256 2838bc0a53a75f2b…

MALICIOUS

PDF

87.9 KB Created: 2021-03-24 08:52:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44a0f946ebfd4dc4c464650e5467d62f SHA-1: efd2305db0b335bac462c6c98377d94242fd6e39 SHA-256: 2838bc0a53a75f2b8d7ce375111da0f5b66009319fe8b84ceddf351863cb3c6c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to a URL that mimics a search result, likely intended to trick the user into downloading further malicious content. No scripts were extracted, but the presence of embedded URLs and the nature of the heuristics suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=elements+of+ecology+smith+9th+edition+pdf+download
    • http://zobuzireb.22web.org/tamil_news_paper_whatsapp_group_link.pdf
    • http://supariwepexafat.mywebcommunity.org/36632844408.pdf
    • http://rejorevubirobu.sportsontheweb.net/att_4_handset_cordless_answering_system_manual.pdf
    • http://xejomukeg.22web.org/2000_yamaha_v_star_1100_classic_service_manual.pdf
    • http://bosajefidil.iblogger.org/46422942898.pdf
    • http://dopepaba.iblogger.org/learned_optimism.pdf
    • http://kedepoba.sportsontheweb.net/appropriate_technology_for_rural_development.pdf
    • http://kakafeg.scienceontheweb.net/why_is_my_xfinity_tv_box_blinking_green.pdf
    • http://zozegakipuvi.iblogger.org/78881122524.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gomakobez/zodefunibazafezefolavafo.pdf
    • http://rujidafedisezu.atwebpages.com/66265977814.pdf
    • http://kabofed.rf.gd/acuerdo_de_paz_la_habana.pdf
    • https://s3.amazonaws.com/wovisak/xuvatedabunineruwetatuzow.pdf
    • https://s3.amazonaws.com/zulezov/encyclopedia_britannica_books.pdf
    • https://s3.amazonaws.com/vokeri/wisivus.pdf
    • https://52f9d6e5-2fd5-4906-a030-4d12f703b62a.filesusr.com/ugd/297ecd_2bd22a0ce6ee48c0aa61b7c05eeb8ddc.pdf?index=true
    • https://s3.amazonaws.com/mokixetat/75627629496.pdf
    • https://b2d1eea7-aef5-47fc-962c-88b5513ecafc.filesusr.com/ugd/3a57bc_ee93db973e9f441590130b5f5fb318e8.pdf?index=true
    • https://99ca13e2-8bf0-45b2-93fa-bbfb519f101f.filesusr.com/ugd/5392be_59e37c4dfbc844988c8a13af84b58786.pdf?index=true
    • https://s3.amazonaws.com/varolexexus/android_find_stored_wifi_password.pdf
    • http://bakilipos.epizy.com/mapa_conceptual_de_conceptos_basicos_de_estadistica.pdf
    • https://9a89a7da-ede3-42eb-a537-7416be21eb2d.filesusr.com/ugd/aaaf79_d2e0da4f655841848b56aa019126c763.pdf?index=true
    • https://e824aeac-d22a-4b45-bb3c-17051d6ee04f.filesusr.com/ugd/de60da_12af99dda3c249789b22f386d3b6e752.pdf?index=true
    • http://xifidoragu.rf.gd/100_deadly_skills_survival_edition_download.pdf
    • http://supabije.rf.gd/carrabba_s_gluten_free_menu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000115bf.bin
dcbf1bc28cba2627096001a28c4b068a24c2223df2883b89dbd6e18300ef274e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115BF 5780 bytes
font_01_sfnt_off0001296e.bin
c696d76732148c7424e660226db784c99b8c397013ab0e2ebb19fd659075c035		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1296E 12140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.