Malicious PDF — malware analysis report

Static analysis result for SHA-256 351a4844b4cce414…

MALICIOUS

PDF

576.5 KB Created: 2021-04-14 22:10:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 983778bfe2f2a6211d1f2a666c57f6c4 SHA-1: 94fba42c0cff0b1cb0ab4df9e0d89dd79a3f7c9a SHA-256: 351a4844b4cce414c22b1069245400711a082a2319b3f974d475667890050c40
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URI that points to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The heuristic 'SE_URGENCY_LURE' suggests the document content attempts to create a false sense of urgency to prompt user interaction. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs indicate a likely phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7686

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=what+does+lick+mean+in+huckleberry+finn PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4458622/normal_6022109ebafc0.pdfIn PDF document text
    • https://cdn.sqhk.co/xexisini/LjejcQG/51279606810.pdfIn PDF document text
    • https://cdn.sqhk.co/nomazotesi/cLpieih/agribusiness_management_ebook.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476437/normal_5fd164136824b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369907/normal_60697ed96c7dc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465392/normal_5ffba40caacc5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425491/normal_5ff9f3963bd6d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446264/normal_5fe36f78e38c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369900/normal_6015b1699ebff.pdfIn PDF document text
    • https://cdn.sqhk.co/pemiduwegam/dKTeijq/musica_de_los_ochenta_gratis.pdfIn PDF document text
    • https://cdn.sqhk.co/lamiwifa/e2hihe1/play_poker_offline_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454172/normal_603eb1328c094.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://4ef57e19-9a2e-4e6f-a444-f6b59f982a39.filesusr.com/ugd/4c1554_47291171fa0b489e91dad7f8bbee3539.pdf?index=trueIn PDF document text
    • https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_95d9da5d90c14dfe882c423ea884ad29.pdf?index=trueIn PDF document text
    • https://bcbc83ff-a82b-4234-bf1d-c69e8cae54d5.filesusr.com/ugd/057c82_6589f11e3e35477b8bdb14d9df97b6c0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2035b06f-2141-4eff-9200-57dbc5d8011b/jbl_flip_3_se_connect_button.pdfIn PDF document text
    • https://28932ed2-21d9-4123-99cb-fcff0aac4472.filesusr.com/ugd/cc089a_10303c779fe24fd683960ea1e36ca32a.pdf?index=trueIn PDF document text
    • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_c6846b5f1c66453e8300b39d45f97a6d.pdf?index=trueIn PDF document text
    • https://f9c380c0-3c9a-404e-8c76-a924832b335c.filesusr.com/ugd/9c8fb9_a483f9d1cc624c14b16677ed5515a49a.pdf?index=trueIn PDF document text
    • https://36622f5a-5a1b-41a5-aa98-965156e47ac2.filesusr.com/ugd/804ff6_6cf0b8c6f80c4d12acf354e26185c139.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/182f4562-c096-4228-8ee6-89cd409fe9dc/what_is_the_purposes_of_writing.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0008b87d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8B87D 5580 bytes
SHA-256: 28f286be497f8ae8df14c083af580115c921f705ada66bb4507ab538acdd29f0
font_01_sfnt_off0008cb6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8CB6C 10652 bytes
SHA-256: 1acdfd5dcf66b93b4fb25f5b9a29d824e9f759162584c5d65cd766d99d19634b

Open this report in the interactive analyzer, or submit your own file for analysis.