Malicious PDF — malware analysis report

Static analysis result for SHA-256 482c78042208e3ef…

MALICIOUS

PDF

129.8 KB Created: 2021-03-23 05:30:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b7e9c2d84ba751a265fd11f966bfc790 SHA-1: b85fd8b5f9a468110bda89523c102ccd935fbc45 SHA-256: 482c78042208e3ef802663e241ea1d48b0704adf65a4b915c6055f5dfeb60ffb
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF file was flagged by a machine learning classifier and ClamAV as malicious. Heuristics indicate it employs social engineering tactics, specifically instructing the user to copy and paste commands into a terminal, a known ClickFix attack vector. The embedded URL suggests a lure related to 'minecraft bot spammer download'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=minecraft+bot+spammer+download
    • https://cdn-cms.f-static.net/uploads/4456671/normal_601a3343d9042.pdf
    • https://static.s123-cdn-static.com/uploads/4373271/normal_5fc745fec874a.pdf
    • http://sosiwawivijomo.scienceontheweb.net/karpman_triangle.pdf
    • http://gejesixave.scienceontheweb.net/83941293905.pdf
    • http://wipebodu.mypressonline.com/math_radical_rules.pdf
    • https://cdn-cms.f-static.net/uploads/4390057/normal_602edb1671c1a.pdf
    • https://cdn-cms.f-static.net/uploads/4454679/normal_603cf47aab27e.pdf
    • https://static.s123-cdn-static.com/uploads/4476578/normal_5feb0f5d2dea6.pdf
    • http://xenejesujotolud.mypressonline.com/munugekibekeb.pdf
    • http://pedaxofanor.mywebcommunity.org/simplifying_complex_numbers_worksheets.pdf
    • https://cdn-cms.f-static.net/uploads/4459470/normal_604deb038a4e1.pdf
    • https://cdn-cms.f-static.net/uploads/4420776/normal_601bc1e19b432.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pabewuvuxaf.onlinewebshop.net/10546169397.pdf
    • https://s3.amazonaws.com/satulibaren/8102446488.pdf
    • https://336ddc11-c37d-4cd6-9685-7accad2975f7.filesusr.com/ugd/479fa9_ca4bdc2534c348b7af33ee492c0897b8.pdf?index=true
    • https://ac25a69f-a984-4293-9c3d-8c9e0f062535.filesusr.com/ugd/cbf077_e337b4db91f3412681e93576425b2c94.pdf?index=true
    • https://bf23b77b-49a9-4bef-a898-a03cfb94aefa.filesusr.com/ugd/134172_a90f0608bec648fda8f0b47d29535f32.pdf?index=true
    • https://s3.amazonaws.com/sinadi/anuradha_sriram_hit_songs_free.pdf
    • https://a9864912-ad24-422b-99f3-2d90f7703507.filesusr.com/ugd/d6af85_3e74ebb43e0449189498dde85c9e0c9c.pdf?index=true
    • https://bc881323-2374-4635-a2b7-f126f9929bd8.filesusr.com/ugd/546a35_13135f29878b4327a515c7f5ad440ffd.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a78d.bin
9771afaed8832a994d14db06b537a4bf8c39b0be5742b1f4f62da7200c768752		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A78D 5536 bytes
font_01_sfnt_off0001ba61.bin
97988a313a735a23002c05b4b43d5a56e32c1095e9060875aaa0c27a5bbbf650		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BA61 12840 bytes
font_02_sfnt_off0001e470.bin
df1d2c903cabdf2976887e260da0b25217edeb5ce2b71f315001024534e8e210		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E470 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.