Malicious PDF — malware analysis report

Static analysis result for SHA-256 47fcbbf6caa3ca4e…

MALICIOUS

PDF

84.2 KB Created: 2021-03-08 05:56:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0f164a9407c12b053332fe66aaef0024 SHA-1: 339f29d857146a1927a4737d89d879d4cee255fc SHA-256: 47fcbbf6caa3ca4e6203d4bfb2f1769c372633f8b6405b1d6bca6bae21e53a33
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by a machine learning classifier and ClamAV as malicious. It contains heuristics indicating a lure to execute commands via the clipboard, suggesting the user is prompted to copy and paste content into a shell. The embedded URL points to a domain associated with malicious activity, likely serving as a download source for a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=apk+installer+and+launcher+sdk+directory
    • https://cdn.sqhk.co/gulizate/fghm1ij/iihf_world_championship_2020_scores.pdf
    • https://cdn.sqhk.co/malasexek/LEgigjt/50935750832.pdf
    • https://cdn.sqhk.co/kopizikob/8haigdE/crazy_russian_hacker_dog_brush.pdf
    • https://cdn.sqhk.co/wiwuwigo/Hsjdfy0/5402431016.pdf
    • http://fadewujetenuve.mywebcommunity.org/ls_dyna_ale_examples.pdf
    • http://kexedeziferu.sportsontheweb.net/52777954568.pdf
    • https://cdn.sqhk.co/baxotonad/ije4oR4/84462841463.pdf
    • http://bnatural.space/zokabutoxilubowunijeremmf66m.pdf
    • http://vikarevu.22web.org/62416832348.pdf
    • http://reliables.ru/fishbone_analysis_template_word654k4.pdf
    • http://titoto.xyz/790474630589goti.pdf
    • http://fewafef.iblogger.org/77566976515.pdf
    • https://cdn.sqhk.co/xenudipu/icagdje/48141431654.pdf
    • https://cdn.sqhk.co/rufebumu/dDhciaW/all_clicker_heroes_codes_2020.pdf
    • https://cdn.sqhk.co/zivuputid/5L2ic3O/vemelezetavelox.pdf
    • https://cdn.sqhk.co/moviferu/jihjfDH/lawnchair_v2_vs_nova_launcher.pdf
    • https://cdn.sqhk.co/zepipawetopi/iaiak0W/31825781257.pdf
    • http://cashfree.store/open_source_flowchart_software_linuxkiz9g.pdf
    • http://sexedate69.site/47843223834tvgw0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xowilewegiwo.myartsonline.com/how_fast_do_mini_rex_rabbits_grow.pdf
    • http://lubozogemodusa.epizy.com/keto_food_to_avoid_list.pdf
    • http://tarepos.onlinewebshop.net/bar_brothers_workout_program.pdf
    • http://jowokepo.atwebpages.com/fisolepa.pdf
    • http://temusifima.rf.gd/application_to_class_teacher_format.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3a5.bin
f3bb02d3c90724852b898802783e7e5e83dfd4e1a57f6a37ede582ddfb33dcba		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3A5 5316 bytes
font_01_sfnt_off000105bd.bin
13179bddb1861725f0aff6118aa58222a1ce298237e7839bbffab43da7a2fc1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105BD 11192 bytes
font_02_sfnt_off00012bea.bin
557d1d0c408320757a4189326199799dec481dd60303688efee7eb86c25326ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BEA 16564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.