Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d457f21bd634f5c…

MALICIOUS

PDF

74.1 KB Created: 2021-03-25 19:58:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b6fca8dda3afb03f461fd4eab46cf97 SHA-1: 5935dd8711d33672f89a7d22f5555149fe3b7287 SHA-256: 3d457f21bd634f5c8b5a132b25c5cda73d8e5b95152d65fdcc21c9209bfdbffc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a secondary payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'clicker model troubleshooting'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=clicker+model+klik2u+troubleshooting
    • http://rezonansmusic.com/98411774358n3mc5.pdf
    • http://ru-order-687646765445.art/mr_coffee_ecmp50_two_blinking_lightsozqwf.pdf
    • http://okclub.org/cardinal_club_rentals_simpsonville_kysgn9j.pdf
    • http://madewithsunshine.com/71467589266awrn0.pdf
    • http://fafesixokegigi.getenjoyment.net/2970754863.pdf
    • http://moshon.space/hockey_coaching_courses_near_meyim7d.pdf
    • http://habercigo.com/what_is_the_untamed_all_aboutc20d7.pdf
    • http://watertea.space/finding_static_friction_coefficient_lab_reportvlh2l.pdf
    • http://mosebuzixat.mywebcommunity.org/waxixofotejuvefu.pdf
    • http://vikiduxa.mywebcommunity.org/sipifis.pdf
    • http://clobuss.ru/37359602984f9ygr.pdf
    • http://kindraretterath.com/12439194447h9swn.pdf
    • http://ketaton.mywebcommunity.org/appendices_in_thesis_sample.pdf
    • http://donbetosstreettacos.com/47402293090itkpa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://senesijosezetu.myartsonline.com/22667161493.pdf
    • https://s3.amazonaws.com/loranoduzuja/best_cycling_computer_app_android.pdf
    • https://s3.amazonaws.com/xoferuzu/wokoz.pdf
    • https://uploads.strikinglycdn.com/files/ade0aca8-46ad-45c5-bb0a-309cefaa1438/64965586681.pdf
    • https://s3.amazonaws.com/zafijukopa/beginner_bodyweight_workout_routine.pdf
    • https://s3.amazonaws.com/xozeb/digevarodenivel.pdf
    • https://s3.amazonaws.com/sowirutelevolur/traffic_report_hwy_18_oregon.pdf
    • https://uploads.strikinglycdn.com/files/6a1803fb-a923-4ca3-9c44-c158484039f0/average_weight_loss_on_21_day_sugar_detox.pdf
    • https://uploads.strikinglycdn.com/files/dcfec656-c3f6-43c7-b6ef-a40547f5618c/motorola_sbg6580_wireless_connection.pdf
    • https://uploads.strikinglycdn.com/files/3763b59f-2976-4625-bbf2-3288bcd2e992/30564409884.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2fd.bin
fb5734ecb4546e0bc3390304625456689cc327029364134700a9c099899b2511		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2FD 5384 bytes
font_01_sfnt_off0000f525.bin
912a560becfc836757d4062443aa248a63583c3066747718f7e34aeb5676f944		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF525 11256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.