Malicious PDF — malware analysis report

Static analysis result for SHA-256 313fb63690130c39…

MALICIOUS

PDF

74.5 KB Created: 2021-03-23 00:21:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1841447b97fa6171dbcb30c000cd946d SHA-1: e554d00358d1476b100df8a97903763851814016 SHA-256: 313fb63690130c39c1078b529a93ed5e7db61a99cde7b140378655db3d2f61a8
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicates the document's content is designed to prompt the user for a password for an archive, a common tactic to hide malicious content. The embedded URL suggests a potential download source for a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=rar+password+remover
    • https://cdn.sqhk.co/pigexebobe/nibxiFT/48163103270.pdf
    • https://static.s123-cdn-static.com/uploads/4405414/normal_5ffb13766c689.pdf
    • https://cdn.sqhk.co/juwafajem/niaH1hj/ac_odyssey_atlantis_questline.pdf
    • https://cdn.sqhk.co/latosagax/VDiiMgc/arrow_holder_for_bow_case.pdf
    • https://cdn-cms.f-static.net/uploads/4426819/normal_604580beef8c8.pdf
    • http://kokawerawofovi.iblogger.org/cd4538bcn_datasheet.pdf
    • https://cdn.sqhk.co/xidizizo/hehaNgf/construction_simulator_2_guide.pdf
    • https://cdn.sqhk.co/xiroxozalal/ggcgjdW/simple_cake_decorating_ideas_for_weddings.pdf
    • https://cdn.sqhk.co/jivonaxadu/gfajct6/trending_instagram_hashtags_today_2020.pdf
    • https://cdn-cms.f-static.net/uploads/4403687/normal_5fd9ce5207e56.pdf
    • https://cdn.sqhk.co/bunewonu/RjdhfXd/fegomejipegezimuviwuga.pdf
    • https://cdn-cms.f-static.net/uploads/4451565/normal_5fd3a8396b566.pdf
    • https://cdn.sqhk.co/sunomedude/sthhUrI/96606080392.pdf
    • http://vakekaninu.iblogger.org/cbse_class_12_maths_question_paper_2020_download.pdf
    • https://cdn.sqhk.co/zubavagi/ZF8gcKd/xivikewawiluxotafivuzed.pdf
    • https://cdn.sqhk.co/jefutubup/jjjH7hd/plants_vs_zombies_christmas_game_online.pdf
    • https://cdn.sqhk.co/febowozefu/ia7AKij/sage_50_pro_accounting_2018.pdf
    • http://kafikiwamavo.22web.org/82803844389.pdf
    • https://cdn.sqhk.co/dilizilozok/fQWgjhg/guidehouse_insights_navigant.pdf
    • https://cdn-cms.f-static.net/uploads/4383929/normal_60412bc121600.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tibupud.epizy.com/may_2020_telugu_calendar.pdf
    • https://s3.amazonaws.com/dugibabafod/gubederanebubufataveg.pdf
    • https://s3.amazonaws.com/widiku/what_types_of_intermolecular_forces_exist_between_nh3_and_cbr4.pdf
    • https://s3.amazonaws.com/viregujipowuru/zedabuludanefu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e494.bin
416508089134cafc6b6086602bd5f5824ae34e862af9a496025c44236301e011		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE494 5232 bytes
font_01_sfnt_off0000f664.bin
1ecb02ef212e57ecdf419bce4ced6fc065444f80f94dad6e5578f1a2060e1145		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF664 11404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.