Malicious PDF — malware analysis report

Static analysis result for SHA-256 359f3a81efecf4cd…

MALICIOUS

PDF

187.9 KB Created: 2021-02-03 00:46:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 397f22c954329d7bb859fbdbcae4fb58 SHA-1: 16367eff6f8a7d4e51d6a4b0197cd630baed397a SHA-256: 359f3a81efecf4cd363c62a4404d9306e94bc019a084b9ac8777bc6f64d5aa45
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. The document employs a social engineering tactic by luring the user to install a browser extension or update, a common method for distributing malware or stealing credentials. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it may attempt to exploit vulnerabilities or redirect the user to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/aws?utm_term=radio+button+round+border+android PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378604/normal_5fd7811817432.pdfIn PDF document text
    • https://cdn.sqhk.co/sasibasodiwu/BXBXMjj/zimoxuwazuwo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491437/normal_5fc9bc8331d10.pdfIn PDF document text
    • https://cdn.sqhk.co/duponetix/jahehaC/kapi_hospital_tower_2_forum.pdfIn PDF document text
    • https://rajepejejema.weebly.com/uploads/1/3/4/8/134860913/4564887.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481164/normal_5fe90d21cc64d.pdfIn PDF document text
    • https://cdn.sqhk.co/nuditufu/hijghjN/37628639926.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469355/normal_5fdb54c673aec.pdfIn PDF document text
    • https://wikefazopikevi.weebly.com/uploads/1/3/4/7/134715570/mujekejedibewe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470677/normal_5fffa537d11d1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464521/normal_5fccbf17a4e95.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4428341/normal_5fdf46a75a771.pdfIn PDF document text
    • https://mafetoga.weebly.com/uploads/1/3/0/8/130874134/068d9c9e994369.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465701/normal_5fe02f4bacaea.pdfIn PDF document text
    • https://kadibunafi.weebly.com/uploads/1/3/0/9/130969561/024ded.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365580/normal_5fdbe18a00958.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415974/normal_5ffde1b66c837.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fukepez/dogedaxuromu.pdfIn PDF document text
    • https://s3.amazonaws.com/sitok/free_orchestral_vst_plugins.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002a26b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A26B 4756 bytes
SHA-256: 00ba369ec37f86efbcc73c648f4b77d9661255f0143abf8c02ac92c3c0b4c266
font_01_sfnt_off0002b2a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B2A3 14780 bytes
SHA-256: 41e3e3af6a8a8a0f528909b40eb9a1300d6d4043c889de639b70b32b169d1b83

Open this report in the interactive analyzer, or submit your own file for analysis.