Malicious PDF — malware analysis report

Static analysis result for SHA-256 382178d7d2ae8d41…

MALICIOUS

PDF

74.1 KB Created: 2021-03-16 10:35:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c77d2e52193ec1d2c963916bc682d233 SHA-1: 1e64ec5d9058b5b159aeefeb455aee3317a713e5 SHA-256: 382178d7d2ae8d41439735b9899efcc4629f0cbd9e72a3a763ae11ac6fc91491
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to open a password-protected archive, a common tactic to evade gateway security. The embedded URL points to a suspicious domain, suggesting a potential download or redirection point for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=mass+effect+guide+book
    • https://cdn-cms.f-static.net/uploads/4426416/normal_603c603cbbb0c.pdf
    • https://static.s123-cdn-static.com/uploads/4487897/normal_5ffbfba41fd53.pdf
    • http://menetufebev.22web.org/xigemozozumisixuvi.pdf
    • https://static.s123-cdn-static.com/uploads/4425514/normal_5fec3cf43e3fb.pdf
    • https://static.s123-cdn-static.com/uploads/4368742/normal_60068dcb7eb7f.pdf
    • https://cdn-cms.f-static.net/uploads/4488574/normal_602a35f322e36.pdf
    • https://static.s123-cdn-static.com/uploads/4388065/normal_5ff142cebab33.pdf
    • https://cdn-cms.f-static.net/uploads/4452173/normal_6017c423363dc.pdf
    • https://static.s123-cdn-static.com/uploads/4493578/normal_5ffc587a18265.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4ed3e027-65d9-45e7-8a55-5da7f90b36bb/natalie_diaz_when_my_brother_was_an_aztec.pdf
    • http://peraguzenoruwof.rf.gd/wiwitozekejanemaka.pdf
    • https://uploads.strikinglycdn.com/files/4f51abae-7bcd-4226-bb73-837d4d462123/22536510488.pdf
    • https://uploads.strikinglycdn.com/files/863fb4fe-ba33-47e2-a210-ef59d4a24060/rupobolivexefiwejegodapi.pdf
    • https://uploads.strikinglycdn.com/files/34c20c7a-35ff-4043-b455-1ebb327ecc82/principles_of_physics_halliday_resnick_and_walker_10th_edition.pdf
    • https://uploads.strikinglycdn.com/files/c1d64b05-485d-448d-94b6-2e1cab30fb9b/87245344232.pdf
    • https://uploads.strikinglycdn.com/files/68672d88-7a23-434a-b7a6-df31a32a8070/whirlpool_thin_twin_drain_pump.pdf
    • https://uploads.strikinglycdn.com/files/5507d88b-bbfb-4b0c-8f34-a0ccfcb42126/directv_genie_mini_wired_vs_wireless.pdf
    • http://zipokuxabatu.rf.gd/81411513994.pdf
    • http://bufefotekakosed.epizy.com/interview_questions_and_answers_for_medical_assistant.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0ac.bin
515808608f9ec2cccaafab0e28a24c774aee9ae852a0af2049156cccab04fe75		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0AC 5272 bytes
font_01_sfnt_off0000f2c3.bin
0631bce4fde35ecbf78f782bd0152e4a0be88151b18793c2a3763dc9ae57ca59		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2C3 12648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.