Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c3d5d1f038900a6…

MALICIOUS

PDF

256.2 KB Created: 2021-05-24 09:52:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fdf7fcbc44f45fcd3f38fcc93523d5a0 SHA-1: 41af39c4d45b5ccaead025628578303909bfb496 SHA-256: 4c3d5d1f038900a6c1f90d85c03d934fecab988bfc8630531765042ce64545c5
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document flagged by ClamAV as a phishing trojan and exhibits characteristics of an advance-fee scam. It contains an external URI pointing to a suspicious domain, which is likely part of the scam's lure to trick the user into clicking a link for a supposed prize or parcel. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8590

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=the+rock+cycle+worksheet+key
    • https://static.s123-cdn-static.com/uploads/4392873/normal_5fde608f9e5e8.pdf
    • https://cdn-cms.f-static.net/uploads/4387406/normal_60260cd267b55.pdf
    • https://cdn-cms.f-static.net/uploads/4388412/normal_60492cebe9b4b.pdf
    • https://cdn-cms.f-static.net/uploads/4387566/normal_5fe7322b5b235.pdf
    • https://cdn-cms.f-static.net/uploads/4408330/normal_60132fab4a41a.pdf
    • https://cdn-cms.f-static.net/uploads/4478664/normal_601883e28de9f.pdf
    • https://cdn-cms.f-static.net/uploads/4420760/normal_602b781d3b174.pdf
    • https://cdn-cms.f-static.net/uploads/4492573/normal_600c7652cb0b6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/d747aed3-e5ab-4ddf-8e7c-dfb7039db93b/lopizupozenubesas.pdf
    • https://s3.amazonaws.com/goneduzum/types_of_local_anesthesia_in_dentistry.pdf
    • https://s3.amazonaws.com/zidosozawok/dezowusur.pdf
    • https://s3.amazonaws.com/dowadotiju/wellthy_therapeutics_reviews.pdf
    • https://s3.amazonaws.com/redegelesibif/diya_aur_baati_hum_song_lyrics.pdf
    • https://s3.amazonaws.com/dekogamik/sesom.pdf
    • https://s3.amazonaws.com/jusuberu/spring_framework_documentation.pdf
    • https://s3.amazonaws.com/gagagakigibapo/95155479941.pdf
    • https://s3.amazonaws.com/tutasujal/adobe_audition_cs5_bagas31.pdf
    • https://s3.amazonaws.com/tumasun/61652957172.pdf
    • https://s3.amazonaws.com/tesasubawalozan/36848763607.pdf
    • https://uploads.strikinglycdn.com/files/22e17863-c693-4527-ba06-e4759f7e0495/794595967.pdf
    • https://s3.amazonaws.com/mejobu/kefufakanoxeromi.pdf
    • https://uploads.strikinglycdn.com/files/6b1649b2-9a7c-4366-91a4-2182bc3e0f03/young_sherlock_holmes_books_order.pdf
    • https://uploads.strikinglycdn.com/files/ecf5334e-a12e-4db1-aa8f-5744ba1a2fd1/dawukat.pdf
    • https://s3.amazonaws.com/xiwevitox/terraria_queen_bee_expert_mode_guide.pdf
    • https://uploads.strikinglycdn.com/files/8127dadc-7d48-4ede-b85e-15b801540051/radio_shack_micronta_3001_metal_detector_instructions.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00039611.bin
528524602d6c8c8eca186673074181e0dec665aa785be3bbeb4af4128aa5ab92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x39611 3432 bytes
font_01_sfnt_off0003a244.bin
1df7591f2a75ff129424365b7eed9b068a29b2aa1b2247bcfa181779c0d5490d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A244 4520 bytes
font_02_sfnt_off0003b1ca.bin
a1b113a04ed5e957dab4ee74b47365af06983b69265b1478b66c4e5c9cc6da95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B1CA 14340 bytes
font_03_sfnt_off0003e0c5.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E0C5 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.