Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a6ccbca7a99a1eb…

MALICIOUS

PDF

81.7 KB Created: 2021-03-20 15:21:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7b85cf35828e627004a6881b62d8952f SHA-1: 25117ad82d08067eb6961dde0f0df02d8f1230c6 SHA-256: 4a6ccbca7a99a1eb9122e8117088b4d0493ca938fd432e7c53b1f5f8585cc180
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it uses urgency and remote support lures, suggesting an attempt to trick the user into installing malicious software. The embedded URL points to a domain associated with phishing, further supporting this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=service+manual+free+download
    • https://static.s123-cdn-static.com/uploads/4475208/normal_5fc9cbfd8086f.pdf
    • http://coupons2020.info/lexulenositogafakh18s5.pdf
    • https://cdn.sqhk.co/bujiwamovul/dhfiahd/carmageddon_reincarnation_steam_api.pdf
    • http://matcobzor.ru/ashcharyachakit_movie_parents_guidemkkmu.pdf
    • http://palitra-cveta.ru/745024599851gleu.pdf
    • https://cdn-cms.f-static.net/uploads/4369332/normal_6042e3d4308a0.pdf
    • https://cdn.sqhk.co/sesekopusoj/TiajbRv/sngpl_bill_calculation_formula.pdf
    • https://static.s123-cdn-static.com/uploads/4382408/normal_5fe275fe853fc.pdf
    • https://cdn.sqhk.co/sobilowibid/ehihjyC/beautiful_love_baby_images.pdf
    • http://bezprovodov.guru/request_leave_absence_school_templateq7avy.pdf
    • https://cdn.sqhk.co/venitalobeni/OHAigeZ/72552671264.pdf
    • http://matrixbicycles.com/23830461116f10uy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tokafanawa/what_is_the_lesson_of_the_ministers_black_veil.pdf
    • https://s3.amazonaws.com/turip/85048307113.pdf
    • https://s3.amazonaws.com/gowupuzokowuxes/renutisevodaremaruzopa.pdf
    • https://s3.amazonaws.com/mevuzokekenojab/android_app_development_course_in_urdu.pdf
    • https://s3.amazonaws.com/kudefem/chaffoteaux_maury_elexia_ii.pdf
    • https://s3.amazonaws.com/woxojuxafopuv/word_label_template_avery_5167.pdf
    • https://s3.amazonaws.com/sazomo/writing_arguments_a_rhetoric_with_readings_7th_edition.pdf
    • https://s3.amazonaws.com/gateme/nojotogenujazizozat.pdf
    • https://s3.amazonaws.com/jalasilunaz/has_have_had_worksheets_with_answers.pdf
    • https://s3.amazonaws.com/vapelurowar/multiplication_worksheets_5th_grade_100_problems.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100cd.bin
a8ae71ae681636d985491b2d6fb6567ca965562939b539cfe2ea0e7de1e76f8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100CD 5244 bytes
font_01_sfnt_off000112a1.bin
9b25c5d70d7d9ec087adf021123b5f1268beadecfba63fed2156f7145ed17873		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112A1 10848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.