Malicious PDF — malware analysis report

Static analysis result for SHA-256 3436fc6d2844ea50…

MALICIOUS

PDF

69.4 KB Created: 2021-03-29 05:23:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 32390543aee78933c543bda6531c9442 SHA-1: 2d57382cbedef6eff01a2a4174985e7a73124828 SHA-256: 3436fc6d2844ea50fdb9370a18660c738c3b39686e5ccf9f70fea51e0b2fe926
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to a suspicious domain, likely intended to deliver a secondary payload or redirect the user to a phishing site. The document body, though partially obfuscated, suggests a lure related to a 'Whatsapp new update'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=whatsapp+new+update++uptodown
    • http://iwhite.space/can_i_use_my_phone_as_a_remote_for_hisense_tvwjcb7.pdf
    • https://cdn-cms.f-static.net/uploads/4467912/normal_60273c2599aa0.pdf
    • https://static.s123-cdn-static.com/uploads/4462694/normal_600171ae529fb.pdf
    • https://cdn-cms.f-static.net/uploads/4463560/normal_602a0db533d2c.pdf
    • http://yandex-delivery.cc/painting_ideas_canvas_acrylic_easy88axj.pdf
    • http://unlockdeals.shop/83652624817egu89.pdf
    • http://snapchat-alert.com/konugifatizipifr38kf.pdf
    • https://cdn-cms.f-static.net/uploads/4391305/normal_5fd5f4e6ad5d2.pdf
    • http://nikibolerobika.getenjoyment.net/luwaxebe.pdf
    • http://jivusibofonefud.mygamesonline.org/how_to_work_a_dsc_alarm_system.pdf
    • http://socialwave.me/bodaxenq3fji.pdf
    • https://cdn-cms.f-static.net/uploads/4501229/normal_5fd77ec0a9cef.pdf
    • http://thepropheticapp.com/pathfinder_book_listf9b9f.pdf
    • http://xatovapotogu.mywebcommunity.org/21592269262.pdf
    • http://beduzevitugok.mypressonline.com/22116771751.pdf
    • http://peludofnor.fun/components_of_a_progress_reportzffg0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lopakesuzuw.atwebpages.com/highway_geometric_design_lecture_notes.pdf
    • https://f8340159-69ce-4309-ac43-521e9a8475b4.filesusr.com/ugd/bc0b97_3441cbf1fbaf45bfa51da79575a794a3.pdf?index=true
    • https://f803bf1b-e1c2-47f6-a41f-c9785c88fbd4.filesusr.com/ugd/bf07b1_a5885d3dca434bf2adec0829a70d26c2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0618e49d-9a0f-46cf-9674-fb354f5a112d/honda_ec_2000_generator_manual.pdf
    • https://52431b39-7396-4b0c-bcaf-ab72d449a1bf.filesusr.com/ugd/f8cef3_90c80e0f0aa54c548afb1848a8f7b00a.pdf?index=true
    • https://ea74ff18-003d-4094-8454-8d7e15e33abb.filesusr.com/ugd/50de67_212fa2fece324890a049a13e16312ffa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7e681ed4-73de-4185-bdee-b6d221e358d9/fikatafijesetazorofona.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2fd.bin
89a4b940521dd7deee3baf2c1057e485129050a9ca280b9a77c354319294eacc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2FD 5024 bytes
font_01_sfnt_off0000e42a.bin
ea38d8306e0c3e30d3f36f5e1de56068edb89afc6c154f75229e041daf82e4fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE42A 10144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.