Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b504c3527521c6f…

MALICIOUS

PDF

97.4 KB Created: 2021-03-26 12:40:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18d547d9c71831f710936ac256524b0f SHA-1: 0e29249a4a34f846af23f840fc04580620f72901 SHA-256: 2b504c3527521c6f7be79a5fe8a3891490e3f260097c7b15bd0e6cf46e152497
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of an external URI pointing to 'maypoin.ru' suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and heuristic firings strongly suggest it's designed to exploit vulnerabilities or trick the user into navigating to a malicious site, likely for credential harvesting or further malware deployment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=dremel+flex+shaft+225+t2+manual
    • http://mibejar.sportsontheweb.net/nebezudonavegozekedi.pdf
    • https://cdn-cms.f-static.net/uploads/4480748/normal_60595ea901378.pdf
    • http://tramlaweq.online/how_to_play_tabletop_rpg_onlineqcbbn.pdf
    • https://cdn-cms.f-static.net/uploads/4379483/normal_602199da6b587.pdf
    • https://cdn-cms.f-static.net/uploads/4423430/normal_602ee77945134.pdf
    • https://cdn-cms.f-static.net/uploads/4410222/normal_5fdba62e5e99b.pdf
    • https://cdn-cms.f-static.net/uploads/4428039/normal_5fdb605d7032f.pdf
    • http://ziwusis.getenjoyment.net/67235060437.pdf
    • http://5euro.info/25657879551ggwok.pdf
    • https://cdn-cms.f-static.net/uploads/4410433/normal_6016b945456de.pdf
    • http://bumufirila.mygamesonline.org/97447624329.pdf
    • http://rimiripa.mypressonline.com/jovaf.pdf
    • http://sabumow.mygamesonline.org/44735104852.pdf
    • http://jofifuneku.medianewsonline.com/10349547615.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://nopugorib.onlinewebshop.net/kelutinezolulef.pdf
    • http://manuwakagekewu.onlinewebshop.net/96379015725.pdf
    • http://litorow.myartsonline.com/how_to_draw_anime_body_youtube.pdf
    • http://xobebol.onlinewebshop.net/rilerusuwojaw.pdf
    • http://ruruwuvatokatal.onlinewebshop.net/83512091896.pdf
    • http://ziwemasux.myartsonline.com/delighting_in_the_trinity_book.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000117db.bin
f0cbc94eefb714dc6502274d53bc620f52cabd4debec97b8197b3cdfa7a0467d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117DB 5052 bytes
font_01_sfnt_off000128e8.bin
8572b4e283225fffe02214eacb0db3b1bb1af63c5403d6a8d92e93e0c8fec51f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128E8 12744 bytes
font_02_sfnt_off000152fd.bin
2c5f1a2e3d9f683f6a217a47aeaaae813f7d4ef732a5ff54a929695507d09140		 pdf-font-stream PDF embedded font (sfnt) at offset 0x152FD 16092 bytes
font_03_sfnt_off000167c3.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x167C3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.