Malicious PDF — malware analysis report

Static analysis result for SHA-256 35e4eb280f3544cd…

MALICIOUS

PDF

148.1 KB Created: 2021-04-06 04:46:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: be92f558dbec714a5612c956855b716e SHA-1: a5ec8d5ff4a30b5cd49b7064f67fd46d27b59908 SHA-256: 35e4eb280f3544cd4d21d0e5b7a962fa4381b736128973a1b66a60d6cb4cacff
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was identified as malicious by ML classifiers and ClamAV, exhibiting characteristics of an advance-fee scam. The document body, though partially corrupted, suggests a lure related to a government report, likely intended to trick the user into clicking the embedded URL. No scripts were extracted, but the presence of external URIs indicates a potential download or redirection to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=commonwealth+of+kentucky+medicaid+expansion+report
    • https://cdn-cms.f-static.net/uploads/4374199/normal_601e89c71dd9f.pdf
    • https://cdn-cms.f-static.net/uploads/4454561/normal_5fd31eb690594.pdf
    • http://italysummer.fun/mukesobazultc19.pdf
    • http://cashthe.ru/carrello_elevatore_manuale_usato_prezzia9hd2.pdf
    • https://cdn-cms.f-static.net/uploads/4414514/normal_5fe640424253f.pdf
    • https://cdn-cms.f-static.net/uploads/4494160/normal_5fda618e273a9.pdf
    • http://trysoda.club/sovujupinetojenaxozoditfj9xg.pdf
    • https://cdn.sqhk.co/lilomovetum/raNnWhg/love_story_taylor_swift_lyrics_karaoke.pdf
    • http://logmeinnow.xyz/business_english_vocabulary_quiz1rqst.pdf
    • https://cdn-cms.f-static.net/uploads/4421461/normal_60109017970d1.pdf
    • https://cdn.sqhk.co/kikolibub/mjfibVJ/7224223928.pdf
    • http://pefiworawodud.mypressonline.com/mafivuve.pdf
    • http://dufifudusimube.mygamesonline.org/bandura_social_cognitive_theory.pdf
    • https://cdn.sqhk.co/belumozobu/iNIOhbd/jaman.pdf
    • http://fumatiw.mypressonline.com/ielts_speaking_makkar_2020.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/likerajatob/calculations_in_chemistry.pdf
    • https://s3.amazonaws.com/xakajoziwibi/binomische_formeln_mathe_song_lyrics.pdf
    • http://josesomesube.myartsonline.com/in_vitro_antidiabetic_activity.pdf
    • http://maretubozewugi.myartsonline.com/breaking_the_habit_of_being_yourself_joe_dispenza.pdf
    • http://medexode.atwebpages.com/69330237193.pdf
    • http://wawikoduvebakap.onlinewebshop.net/66731448032.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001f878.bin
c285c162cb8f7b001af059ecfbdd6824af106f6c448631ee7a78605fc07eb38f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F878 5624 bytes
font_01_sfnt_off00020b83.bin
87be359339dc6b049cf33b8a6aae8f1022dde6dd3b39dcc0c5612f2da833ded2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20B83 11748 bytes
font_02_sfnt_off00023366.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23366 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.