Malicious PDF — malware analysis report

Static analysis result for SHA-256 3962c7d73cb001fa…

MALICIOUS

PDF

79.8 KB Created: 2020-11-17 18:53:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 4ee47ff9de28ed41441ea5928e2b3a28 SHA-1: d299094f6e354cb53b0089be45c1aa1a10b87a3e SHA-256: 3962c7d73cb001fabcf3cd13d63366ac427258f420d47149aa4987eebd1622b0
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to a suspicious domain, likely intended to host or redirect to a malicious payload. The presence of a 'download' button heuristic further supports the phishing lure attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=dill+mill+gayye+episode+250 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4384628/normal_5f8c582ac2387.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://s3.amazonaws.com/remeranexe/20462016500.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cdbbc3ae-95a3-4b1f-8c89-fb400d3e630f/animal_jam_hack_no_survey_no_downloa.pdfIn PDF document text
    • https://s3.amazonaws.com/miwolezedubujoz/38362584604.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d1c83e7-f3f9-4cc3-97d6-3a34b2de6a31/zupibij.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f43ecc83-ecfd-45c1-a32a-cee5250bd655/51754635764.pdfIn PDF document text
    • https://s3.amazonaws.com/rorives/ferret_raw_diet_plan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b42f1e45-b917-499f-928a-eee9dcab76fd/rarosusogopisim.pdfIn PDF document text
    • https://s3.amazonaws.com/gebaxovudofe/rosuvoturujutub.pdfIn PDF document text
    • https://s3.amazonaws.com/xesigeze/osrs_bloodveld_task_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/jovekus/kuxepop.pdfIn PDF document text
    • https://s3.amazonaws.com/rujabepifar/divine_gift_pathfinder.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/301cb542-c2b6-4453-b524-a69cff161416/pilepogumutizix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67c3f595-db68-41fd-92b6-71af4e5dbad7/19223073769.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42da503f-17f0-44f8-9556-75f8e71920b5/20931726742.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e11f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE11F 3012 bytes
SHA-256: a399fe96af801c2052f662cdbde4f42b4a683414ee7bc8e1620d29cb9b520efd
font_01_sfnt_off0000ebe6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBE6 5680 bytes
SHA-256: e4f88ff52a60f5170f10139b1821a748b3d9243e03e67247285173361d5feecf
font_02_sfnt_off0000ff3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF3E 11632 bytes
SHA-256: 008a5865f69151ffaf9c93ac726648c91b55b3a47314b538d56b04d4d4786db5
font_03_sfnt_off00012711.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12711 2584 bytes
SHA-256: 5e15581b53733698ab8bee8f86ff51b60337a732c487a0bc474dbcf91c186204

Open this report in the interactive analyzer, or submit your own file for analysis.