Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f700d981b98e65c…

MALICIOUS

PDF

76.4 KB Created: 2021-04-02 13:10:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: df356a9462ed4a5fe4a7cbca6a198e77 SHA-1: b8bfd5d0a98c606c4047f71a5a991206fc36c3b0 SHA-256: 4f700d981b98e65c0c4f377eadcd7c586d6137e1f1b82bcbd237b5f9fe1e9939
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded external URLs and a heuristic firing for a 'download button' lure suggests a phishing or social engineering attack. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a downloader or redirector for malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=nift+syllabus+2020+pdf+download
    • https://filalodov.weebly.com/uploads/1/3/4/6/134673241/293180.pdf
    • http://particuliers-societegenerale.xyz/defofufiretevirodazuc8rn5.pdf
    • https://cdn.sqhk.co/zopizote/Ko7oHhd/real_racing_3_apk_mod_obb.pdf
    • http://taforojujutusig.mygamesonline.org/cisco_ccna_routing_and_switching_lab_manual.pdf
    • https://cdn.sqhk.co/nejisakatok/jfhfvif/royal_chaos_banquet_outfits.pdf
    • http://ogranicbio.space/how_to_use_the_color_wheel_in_photoshoplf2jr.pdf
    • https://xatuguje.weebly.com/uploads/1/3/1/8/131856293/6273627.pdf
    • https://sutopudebesi.weebly.com/uploads/1/3/1/4/131438093/sigudabamareruj.pdf
    • http://sportplays.ru/neuman_wl_social_research_methodsx5v96.pdf
    • https://jijaxiwiruba.weebly.com/uploads/1/3/5/3/135333012/sukabivigabagi_resuwemobo_pupepewizizo.pdf
    • https://valojeruxul.weebly.com/uploads/1/3/4/6/134681631/9545791.pdf
    • http://pixunune.sportsontheweb.net/58006321386.pdf
    • http://korogesubelokut.mypressonline.com/what_stocks_to_watch_on_robinhood.pdf
    • http://floradoma.net/solution_calculus_james_stewart_6th_edition6glzr.pdf
    • http://tranquils.space/5702757066h567y.pdf
    • http://com-copyrighit.com/how_to_open_seagate_external_hard_drive_xboxqbaj0.pdf
    • https://cdn.sqhk.co/bawusipa/aggYmjd/jowudufekikojosomof.pdf
    • https://cdn.sqhk.co/letarezetap/CqLhfN7/localizar_mi_android_por_gps.pdf
    • http://folugomobok.getenjoyment.net/71613532240.pdf
    • http://fikosarodone.medianewsonline.com/radio_shack_mpa-250_owners_manual.pdf
    • http://mrshadow.net/formatting_numbered_lists_in_apa75luj.pdf
    • https://cdn.sqhk.co/verexumifo/jgjVUoE/aarp_medicare_advantage_walgreens.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/44e0c547-4651-4c4a-bbed-5c184dd81609/9390635815.pdf
    • https://uploads.strikinglycdn.com/files/d1d82ed5-c647-4b55-9c00-3bae01d6b442/ganetono.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb27.bin
14e6193f1548fc44a66b6ad2eb5bdd62dfdf35a0bd291c96d39ab7ba8a7e261e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB27 5516 bytes
font_01_sfnt_off0000fe19.bin
65e60d0f6be7df76dae56d4c25e5000bf39c783e4e34e298791cac2afafdf83b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE19 11208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.