Malicious PDF — malware analysis report

Static analysis result for SHA-256 356dc3e1978b9e5c…

MALICIOUS

PDF

78.9 KB Created: 2021-03-18 00:23:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c6abb73b153d3bd3db85fed813e9d2f SHA-1: 11be7e5d3f361bc5f918d7f5175bdc5ce9d197c2 SHA-256: 356dc3e1978b9e5cb0f841ff43d251bdcb617137bfc16ad380b948faa37c67b4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'maypoin.ru' suggests an attempt to redirect the user to a potentially harmful site. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution attempt, likely leveraging social engineering through a document seemingly related to climate change.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=ensayo+sobre+cambio+climatico+pdf
    • https://cdn.sqhk.co/wepurodapike/ggOpste/48077448380.pdf
    • https://cdn.sqhk.co/zonurubo/iWDiZuV/change_line_color_after_plot_matlab.pdf
    • http://kusowuwazugup.22web.org/how_to_use_cen_tech_digital_multimeter.pdf
    • https://cdn-cms.f-static.net/uploads/4427104/normal_60151c5c2537f.pdf
    • https://cdn.sqhk.co/posebozej/f3jbTjd/mopar_evts_plans.pdf
    • http://nukuxarigikuxez.iblogger.org/9994072423.pdf
    • http://xeeewq.xyz/muxafukixojuzepupijofb6mh.pdf
    • https://cdn-cms.f-static.net/uploads/4476601/normal_6034821294345.pdf
    • http://mscgis.net/12285885041ui3qa.pdf
    • http://tanuwoxomasosog.22web.org/centroid_of_common_shapes.pdf
    • https://cdn.sqhk.co/kemivabesu/Sheghjf/vofufupasuzeponi.pdf
    • http://dontbeshy.xyz/bexatelustexbl.pdf
    • https://cdn.sqhk.co/lagazowasobo/bovJd3D/50633182998.pdf
    • https://cdn-cms.f-static.net/uploads/4461207/normal_6048ff52504b0.pdf
    • https://cdn.sqhk.co/wifinalimow/Niage2v/3rd_grade_math_test_prep_printable_worksheets.pdf
    • https://cdn.sqhk.co/luxixumogez/piigBjg/marshmello_face_fortnite.pdf
    • https://cdn.sqhk.co/mekewufi/dhfGhjY/bebugatukibavikife.pdf
    • http://arenda-comp.space/4112170311e3grs.pdf
    • https://cdn.sqhk.co/fubebevukad/jshcje0/character_creator_software_for_writers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zakivijojinikij.epizy.com/los_sauces_algernon_blackwood_descargar.pdf
    • http://povosiz.epizy.com/what_does_a_concentrator_nozzle_do.pdf
    • http://bidanop.rf.gd/bodajolegimebidokuva.pdf
    • http://xubedoper.epizy.com/airlift_movie_video_song_tinyjuke.pdf
    • http://fijetetesozaw.epizy.com/assignment_abroad_times_today_free.pdf
    • http://mamotupot.rf.gd/what_is_the_role_of_management_information_systems_in_accounting.pdf
    • http://sukasorepej.rf.gd/showbox_android_box_2018.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f300.bin
48055b8e2df7a2abc1073c2214caa402b198a39377b4b436f29cc457bd7fb61b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF300 5500 bytes
font_01_sfnt_off000105a6.bin
6597660028be04ee9bd3db070c8f4e93f6a883f3c8a8ec1fec9b65dabf283205		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105A6 11884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.