Malicious PDF — malware analysis report

Static analysis result for SHA-256 34977c7cd6cc24e7…

MALICIOUS

PDF

78.0 KB Created: 2021-04-02 08:25:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ad4938157ffb824bf803429fb05c2653 SHA-1: d0afce5c78e5c44301dc9f7810046143b341a74e SHA-256: 34977c7cd6cc24e762ea821e3b607e8a4084544f67e1b90febbe0c0978752217
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by a ClamAV signature and an ML classifier, indicating it's a phishing or trojan PDF. It contains an external URI pointing to a URL that appears to be a lure for downloading a file, disguised as a university application form. The presence of a 'download button' heuristic further supports this phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=university+application+form+sample+pdf
    • https://cdn-cms.f-static.net/uploads/4458150/normal_606643336993b.pdf
    • https://cdn-cms.f-static.net/uploads/4388407/normal_6035d522dabe7.pdf
    • https://cdn-cms.f-static.net/uploads/4461770/normal_60130fde9c186.pdf
    • http://fomoregekamikat.mypressonline.com/jexijotupazibenug.pdf
    • https://static.s123-cdn-static.com/uploads/4408718/normal_5ff3b6f0c00c9.pdf
    • https://cdn-cms.f-static.net/uploads/4471946/normal_604111dc0d390.pdf
    • http://zesamoa.online/how_to_proper_use_yes_in_a_sentencewxmvq.pdf
    • http://bamirajewenexo.medianewsonline.com/59354256509.pdf
    • http://juvizex.sportsontheweb.net/slater_s_rule_practice_problems.pdf
    • http://cybety.xyz/fotidovitanusilag676u.pdf
    • http://bestunew.xyz/widokovupxgofc.pdf
    • http://kulotufiw.mypressonline.com/fundamentals_of_c_language_free_download.pdf
    • http://reactivaperu-2020.com/xumopozikadozopbi1af.pdf
    • http://xuzerujagojagip.scienceontheweb.net/rugikipizez.pdf
    • http://zoom-omsk.ru/zgr_grgl_minecraft_1.14.4f6526.pdf
    • http://lopitimew.mygamesonline.org/nezivobogipe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/titugome/what_is_the_take_5_winning_numbers.pdf
    • https://s3.amazonaws.com/vukusa/alternative_energy_technology.pdf
    • https://s3.amazonaws.com/purawuma/xusesebopazegejowix.pdf
    • https://911f1565-2faa-4874-b261-330d521e7362.filesusr.com/ugd/f46427_be9cf3141bc249ec977ef02993e2d2e6.pdf?index=true
    • https://0dd4521b-3e41-4083-9bcc-807cce03ae78.filesusr.com/ugd/cfe2e9_11ecd8f767834c5399d16e3df9023b29.pdf?index=true
    • https://s3.amazonaws.com/zazelujeju/43126558985.pdf
    • http://mojozore.myartsonline.com/open_the_door_book_by_mittal_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f191.bin
0f4d7b925ddcfffa0bd330af4825ab8b0dbd264c2de9d0ae439b15fd686f2152		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF191 5452 bytes
font_01_sfnt_off0001041a.bin
2738cf792e86cfe9aecaf820f7bdf362629de46a03732570ed7ccdc8604dbc8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1041A 10804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.