Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a5bdb873aff5d6c…

MALICIOUS

PDF

252.0 KB Created: 2021-03-25 18:30:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: de91b4fa97ded7f75e9a7247a25be240 SHA-1: 96ea2038b2ecf4e2d086fd6d09fc67e3fff03f27 SHA-256: 3a5bdb873aff5d6cf281438dcf2cad9b20910ca53b4cefbc01814108c566e1cb
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains a lure for remote support tools, suggesting a pretext for the user to download and execute a payload. The embedded URL points to a domain associated with malicious activity, likely serving as a download source for the secondary stage.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9943

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=learn+online+advertising+pdf
    • https://vimexizud.weebly.com/uploads/1/3/4/7/134755563/7075524.pdf
    • https://cdn-cms.f-static.net/uploads/4446029/normal_603272c1702fe.pdf
    • https://static.s123-cdn-static.com/uploads/4478127/normal_5fe512227c4d7.pdf
    • https://static.s123-cdn-static.com/uploads/4402718/normal_5fe33c1420cfb.pdf
    • https://cdn.sqhk.co/baxoladipezu/hitidid/dragon_hills_2_mod_apk_for_android.pdf
    • https://cdn.sqhk.co/vuzowadijavu/thdjbib/8369006880.pdf
    • http://bestplacefor.rest/apa_format_bibliography_research_paper361ay.pdf
    • https://cdn.sqhk.co/navotezive/tihhhjd/splashtop_business_support_phone_number.pdf
    • http://axecheat5.xyz/what_is_the_role_of_chlorophyll_in_photosynthesis_class_875pej.pdf
    • http://yarrebitteh.online/oracle_sql_substring_last_3_characters1kkmo.pdf
    • https://vifojozajo.weebly.com/uploads/1/3/1/4/131454549/5449936.pdf
    • https://cdn-cms.f-static.net/uploads/4490917/normal_601876087debb.pdf
    • http://jajotagesawize.iblogger.org/what_is_the_speech_aint_i_a_woman_about.pdf
    • http://gizaxeredemuni.22web.org/chainless_bicycle_project_report.pdf
    • http://sweetygirl.club/how_to_make_yourself_fall_asleep_for_a_napxo2bv.pdf
    • https://cdn-cms.f-static.net/uploads/4408464/normal_602ffff5405c3.pdf
    • https://rezusoroporinon.weebly.com/uploads/1/3/2/6/132695427/e7bf8a.pdf
    • https://cdn.sqhk.co/didirepakavi/hdhbYdd/40717308300.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vufupu/exercise_34_frog_cardiovascular_physiology.pdf
    • https://s3.amazonaws.com/jedobufudajewu/64716950349.pdf
    • http://zulexesovo.epizy.com/bosete.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001427a.bin
560842a8ade6996e713223ad5118594ce7efc857d6a1d4f230b71f935ec4be94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1427A 201692 bytes
font_01_sfnt_off0003917d.bin
caff34b721c1ae9f19884420d5564a45cafc80956280983eedc0eb300d771166		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3917D 5208 bytes
font_02_sfnt_off0003a34f.bin
833a4a88ef6d5f9d666e940fc0b6ee837b12d12e441ed8241f0bc8b93a6c8fc8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A34F 11532 bytes
font_03_sfnt_off0003ca76.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CA76 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.