Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e5edc6ba490dbb4…

MALICIOUS

PDF

85.0 KB Created: 2021-03-12 09:54:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c97bdd241f9db9703a8b3d2cc4a72865 SHA-1: 7ff694313d9c5168656a739d0636be3d7077b0ef SHA-256: 4e5edc6ba490dbb4dcbd55beeb7e72eb73c3a46b6d6796e290f822badd617f7d
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs and heuristic firings indicating it is a phishing lure. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggests the document is designed to trick the user into believing they need to decrypt an archive, a common tactic for delivering malware. The ML classifier strongly flagged this PDF as malicious, and ClamAV detected it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=john+grinder+richard+bandler+pdf
    • http://vitofemegawe.getenjoyment.net/20_week_half_ironman_training_plan_intermediate.pdf
    • http://vowujebotoza.mywebcommunity.org/fepuxozudononakopes.pdf
    • http://juwaniwabi.medianewsonline.com/vakenakalakosuguzorabexat.pdf
    • http://kapovulup.mywebcommunity.org/dusekipoj.pdf
    • http://mizebojusur.mypressonline.com/anthony_giddens_en_defensa_de_la_sociologia.pdf
    • http://peteferix.mypressonline.com/xuvodivirisozelologati.pdf
    • http://pasiworuwiwoz.getenjoyment.net/pomonubunip.pdf
    • http://gejokakop.mygamesonline.org/imagenes_de_caras_emociones.pdf
    • http://lebedugipul.mywebcommunity.org/the_book_of_secrets_movie.pdf
    • http://vijofudevadotar.mywebcommunity.org/watermark_app_for_android.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fedufiporara/migidatok.pdf
    • https://uploads.strikinglycdn.com/files/d6a73d71-a44d-48cd-aa26-7a71dba41283/17_golden_sonic_fnas.pdf
    • https://uploads.strikinglycdn.com/files/b47d6975-d99d-4641-8272-d3d89664ce63/heat_exchanger_design_handbook_beaton.pdf
    • http://rewuwuja.onlinewebshop.net/no_boy_no_problem_quotes.pdf
    • https://s3.amazonaws.com/jupevuxirapi/courier_website_design_templates.pdf
    • https://uploads.strikinglycdn.com/files/8284934a-bad4-4ca5-b1f2-8012eef0a8ee/python_programming_language_book_for_beginners.pdf
    • https://uploads.strikinglycdn.com/files/3893b574-d460-4de8-9762-852b779ae88b/ssr_125_motor_mount_bolt.pdf
    • https://s3.amazonaws.com/xufujofaleki/42358091392.pdf
    • https://6b5d12f1-3bbc-48af-9ddb-5430d2fe15e7.filesusr.com/ugd/3bf302_0dc91bf891d34e519c7258168d43a55a.pdf?index=true
    • https://9169454a-6e45-4b39-89c4-5cd9bf0a6084.filesusr.com/ugd/32fbc8_06479360eb1a47d99e77589df985db7b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011181.bin
4cb486d9acc6b8a977c31e2693fb1f1fee04c6bc36e0962d1ea11de24f15db6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11181 5368 bytes
font_01_sfnt_off000123b8.bin
3bece0d59f6914bf745487179c58db3d9a111b61a01b4a413bb49b1302ba7a04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123B8 10196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.