Malicious PDF — malware analysis report

Static analysis result for SHA-256 35927c0da432af3b…

MALICIOUS

PDF

95.3 KB Created: 2021-06-12 00:57:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 2d4f2a93f67b3300d500a7580e8047f1 SHA-1: 6a3a34505ec74489bf9f2956d795d6afc8f2f76a SHA-256: 35927c0da432af3b195170bb20733a4b9aad9b1d26777520c252db3af6c657fb
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.007 JavaScript

The PDF document contains a lure for a browser update or extension installation, a common social engineering tactic. It also embeds an external URI pointing to a suspicious domain, likely for downloading a malicious payload. ClamAV detection and ML classification further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=opera+browser+for+windows+10+pc PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4487625/normal_5fcc2de95d918.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461763/normal_604b4d8ab86c4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419437/normal_604139ef694a8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408184/normal_5fc8728ce59d4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374978/normal_5fcd0bf406ec5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451369/normal_60206f2c5e12a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4495849/normal_5fced0dcf423c.pdfIn PDF document text
    • https://www.opera.comOperatingIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a0a6257-570e-43bc-8201-f2e6d74d863f/who_is_raina_telgemeier_mom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6786707-16ba-47e0-9aba-d60a77af5af6/49905688759.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5ff7d6f-4fa8-4d73-b063-205f80f85b15/55252887101.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1abedd8e-d8a5-445a-aec5-ce7b8b49cc5b/fidunurapuwatatojegupa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bdfab11-5a3c-4eff-beb1-b7671fff5913/fantastic_mr_fox_ash_reddit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa449fbc-401e-4eec-91ba-d112bb99caea/systems_of_inequalities_word_problems_worksheet_kuta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb341077-721c-42c1-9409-3ea41d837be6/92995512043.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0833e1ca-c4f1-4401-877f-ce532f6cfb93/fejazukisoxavoze.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0d20a95-8cd6-4672-bf26-bc16105f6163/32138327714.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b3bc462-a3c8-4368-b11c-78c6f2d13579/greek_god_family_tree.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/134ede89-488f-4d58-a6fb-200a06ca0bfb/49407156450.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49058750-7283-460b-8117-e5219a5fa05c/vonamomigavomo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000133fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x133FA 5568 bytes
SHA-256: 86cba59a93c950d88ccd267840f054aa4dece5eb073eeec80ab07af59afbf1ef
font_01_sfnt_off0001470e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1470E 12480 bytes
SHA-256: 072aa2453a02793afa568d94d47db3c9413a4818f92b11959ad2035b98bcfbaa

Open this report in the interactive analyzer, or submit your own file for analysis.