Malicious PDF — malware analysis report

Static analysis result for SHA-256 45a053fc82c3b571…

MALICIOUS

PDF

75.5 KB Created: 2021-03-20 11:51:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 334aff8b99bf6824f2e2177a568206a0 SHA-1: 12fa26e99216e6ef687f2adbca51c17c2d7280e2 SHA-256: 45a053fc82c3b5716c133bb8d79bb0287fad823b3f3d1a792fca8a12e07e870e
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of an external URI pointing to a suspicious domain, coupled with heuristics indicating a lure to enable content, suggests this PDF is designed to trick users into downloading a secondary payload. While no scripts were explicitly extracted, the PDF structure and external links are indicative of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=xanathar%2527s+guide+to+everything+.pdf PDF link annotation
    • http://13millions-warzone.store/21262541064t3tt6.pdfIn PDF document text
    • http://pugorot.mygamesonline.org/2018_jeep_grand_cherokee_service_intervals.pdfIn PDF document text
    • https://cdn.sqhk.co/rajexizeba/jdHThgm/eset_mobile_security_antivirus_apk_download.pdfIn PDF document text
    • https://cdn.sqhk.co/letarezetap/CvgiczF/ragaduwojak.pdfIn PDF document text
    • https://cdn.sqhk.co/tizudukokeni/Roe6hf5/8218280743.pdfIn PDF document text
    • http://fonudesuwobulud.mygamesonline.org/stihl_hs45_petrol_hedge_trimmer_reviews.pdfIn PDF document text
    • http://reduslim-officialsite.site/report_writing_in_past_or_present_tense7ylq0.pdfIn PDF document text
    • http://miwasigal.mywebcommunity.org/accounting_information_system_hall.pdfIn PDF document text
    • http://toppiksnack.xyz/secrets_of_the_federal_reserve_the_london_connection71b80.pdfIn PDF document text
    • http://xatakafigudu.getenjoyment.net/80454479390.pdfIn PDF document text
    • http://zokiwedilar.mypressonline.com/72166683387.pdfIn PDF document text
    • http://sikakapu.medianewsonline.com/lexamuzitagixolapoj.pdfIn PDF document text
    • https://cdn.sqhk.co/salosegebomi/ibzawgf/how_to_unblock_my_wikipedia_account.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/satulibaren/net_framework_4._5_2_filehippo.pdfIn PDF document text
    • https://ab25a8b3-4d80-4d4b-93a1-c1347014fa7c.filesusr.com/ugd/8d0191_be161b761f1c47e1b5809b070157c5dd.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vixuwogetiv/chemistry_classifying_matter_worksheet_key.pdfIn PDF document text
    • http://dugerem.atwebpages.com/radobeze.pdfIn PDF document text
    • https://s3.amazonaws.com/fowikorejodi/who_makes_dometic_awnings.pdfIn PDF document text
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_91ee608e4062409596ac521ba788d6f2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bulozor/ielts_academic_writing_task_1_examples.pdfIn PDF document text
    • https://0b609444-e5a2-4a7e-9779-a3c6bae51a53.filesusr.com/ugd/529dbf_0cb3abb585b9424abbb83851033c59de.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nafibanefexex/kuwitebuwovizibixenevuma.pdfIn PDF document text
    • https://3f9320ff-391d-49df-b192-c557e211a93c.filesusr.com/ugd/469aea_2e8064e3f001410196c6cc39c086e930.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA8D 5476 bytes
SHA-256: 26e17b2a053d941854365f42aaf35c4af571a9e9bade5900d8be708ec380015e
font_01_sfnt_off0000fd43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD43 10348 bytes
SHA-256: 3564737b929874950d513800b0c121194b897435222157576909684e039d11db

Open this report in the interactive analyzer, or submit your own file for analysis.