Malicious PDF — malware analysis report

Static analysis result for SHA-256 4484c51a91bc9d5c…

MALICIOUS

PDF

84.2 KB Created: 2021-05-11 02:22:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 378a5e3e7ab8295887a70b164fa02245 SHA-1: b2bd32e923145aff421cc24abdb15e3d336d9f6a SHA-256: 4484c51a91bc9d5ced6cb6b4d99fdbe21bf4ccdbce99fb12a91407f87874eb61
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. The 'SE_CALLBACK_LURE' heuristic strongly suggests a callback phishing or tech-support scam, indicated by the document's intent to prompt the user to call a phone number. The embedded URL 'https://vilenefex.ru/strik?utm_term=how+does+poison+damage+work+5e' is likely part of this lure, potentially leading to a malicious site or further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=how+does+poison+damage+work+5e
    • http://tufofol.medianewsonline.com/call_of_duty_modern_warfare_game.pdf
    • https://nikamajavefuxo.weebly.com/uploads/1/3/1/0/131069808/xolanumimaxarese.pdf
    • http://dugabepi.22web.org/cite_mla.pdf
    • http://xujaxul.mywebcommunity.org/how_to_read_digital_vacuum_gauge.pdf
    • http://zadokutasige.22web.org/diploma_cet_2018_syllabus.pdf
    • http://vugoxipagej.iblogger.org/6459810174.pdf
    • http://pefiworawodud.mypressonline.com/37611174146.pdf
    • https://fefezotexarij.weebly.com/uploads/1/3/4/2/134265886/rawexefo_nebabak.pdf
    • https://bokirises.weebly.com/uploads/1/3/1/6/131607331/joliwitubit_razokebezikepax.pdf
    • https://tonavamajarow.weebly.com/uploads/1/3/4/6/134694337/rekaka.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jezuboteseg.epizy.com/what_is_the_network_security_key_for_hp_deskjet_2600.pdf
    • http://fefukidu.epizy.com/49452108545.pdf
    • https://s3.amazonaws.com/nunakixuma/6059550537.pdf
    • http://pofisijakot.epizy.com/motivation_letter_for_internship_application.pdf
    • http://gilupusaxuzamo.epizy.com/agenda_2020_y_ods.pdf
    • https://s3.amazonaws.com/likerajatob/rimubusula.pdf
    • https://s3.amazonaws.com/tiduro/rolibenuxufutumanetadi.pdf
    • https://s3.amazonaws.com/waxegatulo/bewelozejerifil.pdf
    • https://s3.amazonaws.com/jofunozuzof/vunuzafasa.pdf
    • http://lujubozugib.epizy.com/kiwitovu.pdf
    • http://demosegepare.rf.gd/97686565353.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b4b.bin
0a823a5b972efd8044d2f0eb69442ed1183e71e4890810146034949c639333ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B4B 5488 bytes
font_01_sfnt_off00011df6.bin
e408adcee4ada3b1ecc1cceb76eba2126c87aed0391d19c64779f6cec388ba53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DF6 11100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.