Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b69fda4d503c546…

MALICIOUS

PDF

89.3 KB Created: 2021-03-05 00:45:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54a2d60563f926303541b205404a9221 SHA-1: dd806d3fca8fdb19e7e2cf774ae0328e28083dd7 SHA-256: 2b69fda4d503c546658185f3b1ffaa5ffe80cca4e9c95cae56a138b3cad6865e
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, and contains multiple external URLs. The heuristic 'SE_URGENCY_LURE' suggests the document body attempts to create a sense of urgency to prompt user interaction. The presence of embedded URLs and the overall detection profile indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=how+to+get+real+time+on+thinkorswim
    • http://kosamaritaj.getenjoyment.net/21533020908.pdf
    • https://cdn.sqhk.co/womilepeba/hiDhhVf/56945015221.pdf
    • https://cdn-cms.f-static.net/uploads/4495265/normal_60183843a00d7.pdf
    • http://tibetterrier.ru/what_are_the_principles_of_social_psychologycitc4.pdf
    • https://cdn.sqhk.co/kanemili/uhcFRjG/pdf_reader_viewer_2020_apk.pdf
    • https://bozobamawokoruv.weebly.com/uploads/1/3/4/3/134350924/gedikoxad_bobage_batonusodu_gananov.pdf
    • https://cdn-cms.f-static.net/uploads/4371272/normal_60255aca749ca.pdf
    • https://fexifeter.weebly.com/uploads/1/3/4/6/134612515/3687649.pdf
    • https://static.s123-cdn-static.com/uploads/4375507/normal_5ff3f9e6d4b55.pdf
    • http://vexetifiridik.mypressonline.com/google_maps_satellite_view_history.pdf
    • http://fullstacket.online/why_is_positive_discipline_more_effective_than_punishmenth6kxm.pdf
    • https://cdn-cms.f-static.net/uploads/4403681/normal_5fd7700767c70.pdf
    • https://cdn-cms.f-static.net/uploads/4487194/normal_6033bc84748e0.pdf
    • https://cdn.sqhk.co/xonepogafix/jgDUqhj/2_guns_movie_download_moviescounter.pdf
    • https://cdn.sqhk.co/pakebisas/7jgYjhD/soap_cutter_making.pdf
    • https://cdn.sqhk.co/femogefuv/dgeMlno/redecor_home_design_game_review.pdf
    • http://lapitubemexidi.mywebcommunity.org/what_is_the_best_hedge_trimmer_on_the_market.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tunivepusage.epizy.com/kinovagoviwamofomil.pdf
    • http://rosevasejila.myartsonline.com/munudiler.pdf
    • http://rafodize.rf.gd/arjun_reddy_hd_movie_tamil_dubbed.pdf
    • http://wowinagapujepok.epizy.com/ashokan_farewell_classical_guitar_sheet_music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5c6.bin
6b33ff188d28154d6dbdbf812d80b7b44c2f9bc5adfe8bd5e5c9793c1c79fec7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5C6 6476 bytes
font_01_sfnt_off0000f5ce.bin
e1b7bc138455c0a1ad30f4c177f01d1b2a275cc099e6921d51d7567177a92f73		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5CE 5216 bytes
font_02_sfnt_off00010769.bin
0c92f3df404ccb72b8b926cad59fa5c67e926a8ef73c210dfa4044427dbaf6a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10769 6380 bytes
font_03_sfnt_off00011ce4.bin
c2753378cc9954955a3f656f861cc1aee46118430429694586810e6e3de4ca19		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CE4 10836 bytes
font_04_sfnt_off000141e3.bin
ac33519e124c3ea264ad7eeaadaa37b9611ede3ed7064c609661e0a8f12a1e56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141E3 16080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.