Malicious PDF — malware analysis report

Static analysis result for SHA-256 35c8f2a47f6141f9…

MALICIOUS

PDF

77.6 KB Created: 2021-05-08 03:55:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dcf4c5adff4c2e41583414d7ccf1a736 SHA-1: eb216c098f790e2d6e5cf18ca7f4a063e269aa39 SHA-256: 35c8f2a47f6141f9da5578de47a3dc044ca24457e0dd8246e5466ed53e0ae432
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains references to 'Internet manager 6. 35 build 5 crack', suggesting a lure for cracked software. The presence of numerous embedded URLs, many pointing to PDF files hosted on various domains, indicates a potential download or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/ilo85tqlvfjt24cajcr6uqkg07/zipeguxatopubovuwugukusul.pdf
    • http://absolutelyneon.com/userfiles/file/lisetaboxef.pdf
    • https://www.skyline-recruiting.com/wp-content/plugins/super-forms/uploads/php/files/2e58deb446667c933f4c3df6ce7ffa2a/muvene.pdf
    • https://www.sahabatkeluargahomecare.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d063508769---nuxidebevijumimurifozin.pdf
    • https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/160766f137c252---walikitigulilumol.pdf
    • https://mosoptagro.ru/wp-content/plugins/super-forms/uploads/php/files/61aea43e4681d4c1c88ca13f79efbd3f/2902095036.pdf
    • http://math-talk.kr/wp-content/plugins/super-forms/uploads/php/files/ktfjbj065r8acvp2huqg2ao7ga/juxoneliwupavuwitiwomudof.pdf
    • http://www.ncstarim.com.tr/wp-content/plugins/super-forms/uploads/php/files/r731ni93ba39eil18krs047215/74291761892.pdf
    • https://www.travelticket.com.au/wp-content/plugins/super-forms/uploads/php/files/p6cceq01mqdjrv67dhqti42q4k/17087767912.pdf
    • https://alphaveneers.co.uk/wp-content/plugins/super-forms/uploads/php/files/1014429bad73ae6b404e5ccbc8bf6614/70114824834.pdf
    • https://shining4u.com/wp-content/plugins/super-forms/uploads/php/files/c42ec9586173677c105358afe980d2e2/62999042610.pdf
    • https://wills.sg/wp-content/plugins/super-forms/uploads/php/files/4fb2d3bcfb30ae91f17c1099084a3c6e/bodusugabonidobaw.pdf
    • https://moniimpex.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074634c3e392---97891989966.pdf
    • http://lirealestatelitigator.com/wp-content/plugins/super-forms/uploads/php/files/6a2c245ee244cefc031bd69ad697d6b5/90027395887.pdf
    • http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095b7051f79c---89385681900.pdf
    • https://hightechrustremovers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1606c920e9e7a0---77581655138.pdf
    • https://joyfool.art/wp-content/plugins/super-forms/uploads/php/files/d9558f1d4b0ea0518320a78eea2e0503/8135180412.pdf
    • http://www.afamaresme.org/wp-content/plugins/formcraft/file-upload/server/content/files/160763c294a02a---fupojulenokixa.pdf
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d37f0c37f2---lominerifa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/6naE_Nh8_CY/uplcv?utm_term=internet++manager+6.+35+build+5+crack
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0d3.bin
1def15dffb541e4f14560567ae77c0859d2ef2abea93efe5e2952931c8c9bb17		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0D3 5696 bytes
font_01_sfnt_off0001041b.bin
8093f3d71d552faaa341f0a76768a08cb7dee263a7fbf584b341f9c0309e153a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1041B 10776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.