Malicious PDF — malware analysis report

Static analysis result for SHA-256 45b7f0de8c3e2370…

MALICIOUS

PDF

156.2 KB Created: 2021-04-06 13:51:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dbe2faf6899e3710814699d3cde7b40e SHA-1: b8d97058b8e81f77d8df0c532bbc697b57be2030 SHA-256: 45b7f0de8c3e2370e9514cee2dbcb3fbd24b5142deafcddd7d9d302d8f628be2
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'crophysi.ru', which is likely part of a phishing lure. The presence of a 'download button' heuristic further supports the attack pattern of tricking users into downloading a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9932

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/123?utm_term=feeling+angry+whatsapp+status+video
    • http://mon-fortuneo.best/anything_something_nothing_everything_exercises9dfga.pdf
    • http://zonitupupafof.sportsontheweb.net/lakumurosetufojeju.pdf
    • https://cdn-cms.f-static.net/uploads/4451210/normal_604cc63fae798.pdf
    • https://fepepifufom.weebly.com/uploads/1/3/1/8/131872298/fokumamibo.pdf
    • https://static.s123-cdn-static.com/uploads/4415964/normal_5fcebf8c87cb7.pdf
    • https://jabifuvos.weebly.com/uploads/1/3/1/0/131070291/9571526.pdf
    • http://roborezi.iblogger.org/optiplex_755_ram_compatibility.pdf
    • https://static.s123-cdn-static.com/uploads/4489969/normal_6005566aeac9b.pdf
    • http://lexaxak.mywebcommunity.org/approach_to_gi_bleeding.pdf
    • https://vewudati.weebly.com/uploads/1/3/0/8/130873955/pewerekipe.pdf
    • https://sitasujo.weebly.com/uploads/1/3/4/8/134876827/6635771.pdf
    • https://cdn-cms.f-static.net/uploads/4379355/normal_6027076c50b0e.pdf
    • http://sellamorem.com/68901443799kcx1h.pdf
    • http://dasazopemobor.mywebcommunity.org/genetics_from_genes_to_genomes_solutions_manual.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/bdc25808-86b5-4eeb-b95a-28edd6144b96/xuvaludes.pdf
    • http://siwofemevap.epizy.com/2016_chevy_sonic_ltz_owners_manual.pdf
    • https://uploads.strikinglycdn.com/files/3cf07cda-7d65-4e36-8d1b-357f1a4fe918/zazovutuvawikoxeneni.pdf
    • https://uploads.strikinglycdn.com/files/1133b348-16f4-48da-9e81-376912a7a33b/porowibo.pdf
    • http://fobixejavol.rf.gd/90688690677.pdf
    • https://uploads.strikinglycdn.com/files/191a93b7-f9a4-4441-b14b-d357c4e14c9b/mopagavixit.pdf
    • https://uploads.strikinglycdn.com/files/7955a4b8-18a2-41a7-a490-c8cc1ae13526/how_to_do_an_if_then_statement_in_excel_with_multiple_conditions.pdf
    • http://vapodizasogore.epizy.com/tekodowidedasinasewafo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d706.bin
d80963bbc78d18124c32ffceee3158feb1267a52509f89e0d2a54449b4c8d81e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D706 5312 bytes
font_01_sfnt_off0001e91c.bin
86de1580c588d9d8e590865e6c60b8e5f0522f3997d53b9b296f3f20ed38f620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E91C 6604 bytes
font_02_sfnt_off0001fb81.bin
d74297415d6c87f545166f40d05970eb84cb062bb556d08a93f3ac0eefc59e12		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FB81 12632 bytes
font_03_sfnt_off0002269e.bin
60f53b17f7925ac1818ac9336ea58fd206fea48872b5377b70e6fb8114080afd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2269E 16132 bytes
font_04_sfnt_off00023b91.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23B91 4324 bytes
font_05_sfnt_off00024990.bin
521c8066a3fb2cb7e63621db58fd5e0633576502a891b7556ed44ebb2029a0e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24990 6816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.