Malicious PDF — malware analysis report

Static analysis result for SHA-256 33a7ba75574267b9…

MALICIOUS

PDF

81.6 KB Created: 2021-03-16 20:24:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 6415b1eaf5adc8995fe550b19cc10e39 SHA-1: a2acc3b2bac7a3dfdc5df68843a599297bb97eae SHA-256: 33a7ba75574267b948c654df0487c33335e8dcf3f837b36868c1360dfdd8547d
216 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a 'Recovery secret / private key request' lure, indicating a phishing attempt. It also contains an embedded URI pointing to a suspicious domain, likely for malware distribution or phishing. ClamAV detection further confirms its malicious nature, identifying it as Pdf.Phishing.Trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=tax+on+salary+in+cambodia+2020+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nisoxow/daddy_as_an_autobiographical_poem.pdfIn PDF document text
    • https://2ac56fc1-f7ee-4366-9cb2-1681469c68ee.filesusr.com/ugd/b914b5_e6a09677028d42e8bd0bba0520093394.pdf?index=trueIn PDF document text
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_464f39d0572f422786bebbe05959db10.pdf?index=trueIn PDF document text
    • https://77bac38d-831a-46d6-8f22-d7743fcadc58.filesusr.com/ugd/5b9a87_b568d88ac83d4b5c9be484aa55068762.pdf?index=trueIn PDF document text
    • https://9d76d0c6-5807-43ac-a2ba-7b4112d1a20a.filesusr.com/ugd/5cd33b_d625a9e0c96a4f34ad90d6ef2e72d889.pdf?index=trueIn PDF document text
    • https://29ca30ec-7ad4-487f-8637-d2d67f3a323c.filesusr.com/ugd/10b11f_3d4a9376c0ea4bcca3abc518cc2581aa.pdf?index=trueIn PDF document text
    • https://66547991-fb4b-492c-b271-2b6457db34f0.filesusr.com/ugd/a98e70_2219b3d7adba400d97d6247b56ba199e.pdf?index=trueIn PDF document text
    • http://jaterivi.epizy.com/how_to_use_phonemic_awareness_in_the_classroom.pdfIn PDF document text
    • https://99442e0c-e188-470f-b1e9-a2082f9e7f28.filesusr.com/ugd/2274a7_8aecc5829e464e02953ecaa057564cf7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tubupejevomo/zexuti.pdfIn PDF document text
    • https://b81e1767-bb0d-4562-9f98-cfef66859bb1.filesusr.com/ugd/b48b60_cc8f7c202e3e416bb1df61ff6cb666ac.pdf?index=trueIn PDF document text
    • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_24e395307db24c36a269b6847e1908ee.pdf?index=trueIn PDF document text
    • https://a97cc435-ef8e-4ffb-8544-4b9c0bda5a6e.filesusr.com/ugd/7ab440_fb617ce8a6f84998a681a8a1c69dfc4e.pdf?index=trueIn PDF document text
    • https://67a4337f-2b79-4d04-9c1d-2578c80f4945.filesusr.com/ugd/964009_d12f1c762e7d468598604da2caab2e2b.pdf?index=trueIn PDF document text
    • http://bizower.rf.gd/davetidetavif.pdfIn PDF document text
    • https://s3.amazonaws.com/tutasujal/maier_sports_size_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/mozirolinitaje/68600857350.pdfIn PDF document text
    • https://938a05da-450f-421e-a59b-0448473a402a.filesusr.com/ugd/cb5dea_0eb4bb4cf4904feab2a88f686b773fb2.pdf?index=trueIn PDF document text
    • https://28ae28a3-27cc-4d38-be83-0de1f6925f83.filesusr.com/ugd/454016_b09e870a333c4c62aa03c9c12a98e3e0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/migivewuwe/kixivodanavamuta.pdfIn PDF document text
    • https://s3.amazonaws.com/teximikamukubo/petrol_expenses_claim_form_template.pdfIn PDF document text
    • https://s3.amazonaws.com/xesigeze/towizowemaduson.pdfIn PDF document text
    • https://s3.amazonaws.com/zupenafud/lord_of_the_rings_return_of_the_king_won_eleven_oscars_fact_or_opinion.pdfIn PDF document text
    • https://s3.amazonaws.com/zuwosil/xaxukijusigufata.pdfIn PDF document text
    • https://9df6e0af-a028-4e88-91ba-61a1b37318d5.filesusr.com/ugd/7c1f05_1090b36981384bb5b4bb7f29339243a5.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC7B 5836 bytes
SHA-256: f25a76faa7689b6476f3e95ef81e64aa7d127709f456dc6ce70f373c3e6918f0
font_01_sfnt_off00010044.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10044 4264 bytes
SHA-256: a515c63f31f1979f7270cca939890a20dc1f7a218ad0f457b58d362ea5f82131
font_02_sfnt_off00010fb5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10FB5 11472 bytes
SHA-256: 817d0ce2deafe7fd950a11d25ae8b11571e9e8738540d2c21fdcfd5d92be5397

Open this report in the interactive analyzer, or submit your own file for analysis.