Malicious PDF — malware analysis report

Static analysis result for SHA-256 38e39473bfbdcadd…

MALICIOUS

PDF

120.0 KB Created: 2021-03-24 15:06:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 84281c4d79a834d35a438c1310402b6d SHA-1: d2bfdd022bba387b8f6c9f943e16f8ffa1afb192 SHA-256: 38e39473bfbdcadd85e71619a7cb1f99ac016e238f9562fb59a1595e0549e0fe
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically indicating a phishing or trojan threat. It contains an embedded URL pointing to a suspicious domain, likely intended to host a secondary payload. The presence of a download button heuristic further supports the phishing lure attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=pantone+geet+fuel+processor
    • https://cdn-cms.f-static.net/uploads/4381738/normal_602c97318a8dc.pdf
    • https://static.s123-cdn-static.com/uploads/4417422/normal_600006b86f192.pdf
    • http://helpverifybadges.com/schaums_outline_of_electromagnetics_4th_editionnj0bv.pdf
    • http://zikapipumimapo.22web.org/what_are_all_the_different_names_for_god_in_the_bible.pdf
    • http://salopkisa.website/bezatugotepokirybxum.pdf
    • https://static.s123-cdn-static.com/uploads/4369760/normal_5ffef7ff618db.pdf
    • http://sevastopol.sale/brussels_belgium_visitor_guide3spfk.pdf
    • https://static.s123-cdn-static.com/uploads/4465545/normal_5fe15ade02a96.pdf
    • http://brumbum3.xyz/complaints_procedure_template_nhsimcpt.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://05790d5e-93e9-4545-bcc4-99c37f081c18.filesusr.com/ugd/bff4d5_7583ece4cc45455fbe196abc020e40c8.pdf?index=true
    • https://s3.amazonaws.com/buponuwebi/din_en_iso_2409_gitterschnittprfung.pdf
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_4b581b7e16a94eca80ee6e09522bb018.pdf?index=true
    • http://mupegutiwigo.epizy.com/rukosegavekomo.pdf
    • http://tudafaketewud.rf.gd/3_bedroom_floor_plans.pdf
    • https://f85e9a30-dbb9-40fd-a66d-53bd7daafe07.filesusr.com/ugd/1b9faa_3e7f819a94b74b9691fc4c99e9ddc1a2.pdf?index=true
    • https://146c8b6c-0b46-450b-8ed0-b45f1e2a4974.filesusr.com/ugd/b58d21_b0b0e81ec2a64d3992b0b66bc28c6ebe.pdf?index=true
    • http://faxipobusevive.rf.gd/helical_antenna_design_equations.pdf
    • https://s3.amazonaws.com/xotomisen/54801634728.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019780.bin
e7aa3615ca7e62f00fcd69a9d7219caea88c8eb03912d54fbcdde397079baed8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19780 5184 bytes
font_01_sfnt_off0001a93e.bin
7a81227e68a456be9f0d169355fd85a696631a41287b6cf925d507f8205a2108		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A93E 12076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.