Malicious PDF — malware analysis report

Static analysis result for SHA-256 5278fe84f38c75ca…

MALICIOUS

PDF

151.7 KB Created: 2021-06-01 16:23:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 948476bf4d45b6e3a08ce4951c5cd884 SHA-1: 916eed4a9c659f88f7e9e360bfe02a7a64070211 SHA-256: 5278fe84f38c75cac146b71135dcca5079e4d7c8cf57bb3c55b9d7ae433902be
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a site offering a PDF download, which is a common lure for phishing or malware distribution. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a legitimate download link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9930

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/pbw?utm_term=development+across+the+lifespan+9th+edition+pdf+free+download
    • https://cdn-cms.f-static.net/uploads/4378171/normal_604daad2861ca.pdf
    • https://befukifesili.weebly.com/uploads/1/3/1/4/131453358/xaluwep.pdf
    • https://cdn-cms.f-static.net/uploads/4389352/normal_606692ae8bca5.pdf
    • https://cdn-cms.f-static.net/uploads/4393641/normal_605d88c2f23aa.pdf
    • https://kivomulugan.weebly.com/uploads/1/3/2/6/132695939/9565132.pdf
    • https://zoditasus.weebly.com/uploads/1/3/4/6/134670667/8140418.pdf
    • https://wofogubegir.weebly.com/uploads/1/3/4/7/134728038/wubakafaniwuwen.pdf
    • https://static.s123-cdn-static.com/uploads/4473637/normal_5fc9783ec718b.pdf
    • https://cdn-cms.f-static.net/uploads/4415526/normal_5fdb7be39637f.pdf
    • https://static.s123-cdn-static.com/uploads/4485443/normal_5fcdc41cc0508.pdf
    • https://cdn-cms.f-static.net/uploads/4368996/normal_60484ba816c16.pdf
    • https://kixuvatapowow.weebly.com/uploads/1/3/1/3/131383305/kevojetutexetepo.pdf
    • https://depesusexufajev.weebly.com/uploads/1/3/5/3/135351117/d194b73.pdf
    • https://static.s123-cdn-static.com/uploads/4379387/normal_5fdf5992a1611.pdf
    • https://sopazamiwurigu.weebly.com/uploads/1/3/4/3/134387891/pivisava.pdf
    • https://cdn-cms.f-static.net/uploads/4493600/normal_6015d429aec7f.pdf
    • https://cdn-cms.f-static.net/uploads/4487416/normal_600fb48950679.pdf
    • https://vakejijumusefuv.weebly.com/uploads/1/3/5/3/135313512/8785524.pdf
    • https://cdn-cms.f-static.net/uploads/4481059/normal_605b5a3ff3373.pdf
    • https://cdn-cms.f-static.net/uploads/4455670/normal_602ef7a29490c.pdf
    • https://nolipugi.weebly.com/uploads/1/3/4/6/134652161/jevilekesudaned.pdf
    • https://cdn-cms.f-static.net/uploads/4382421/normal_606b64b5d21c1.pdf
    • https://guvisine.weebly.com/uploads/1/3/4/5/134598756/4475476.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/6d0884e2-1791-419f-b6a0-4327c241b59a/how_to_get_robux_for_free_in_2021_free_robux_promo_codes_roblox.pdf
    • https://uploads.strikinglycdn.com/files/8390c7c1-22f2-4022-8c1e-7cc4ba27625a/attack_on_titan_manga_chapter_release_dates.pdf
    • https://uploads.strikinglycdn.com/files/71a37928-9f68-4872-9518-0c351bb357ef/how_do_i_get_a_replacement_safeway_club_card.pdf
    • https://uploads.strikinglycdn.com/files/1a8bd458-e56e-4def-a168-3a9e94bd9b1b/fikoxavu.pdf
    • https://uploads.strikinglycdn.com/files/75311d76-13c2-43b2-b8b5-16debba52c2b/kijimubileguxajenofu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000207c7.bin
534ea3a9439af28f539f70c385ecf52d30500433728336700cb45c38c7aa777d
pdf-font-stream PDF embedded font (sfnt) at offset 0x207C7 5488 bytes
font_01_sfnt_off00021a54.bin
e37a1b59925324a1b020d7236cf15f1ee856d3580bda61eee3f5cdce8c087592
pdf-font-stream PDF embedded font (sfnt) at offset 0x21A54 11828 bytes
font_02_sfnt_off000241b5.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3
pdf-font-stream PDF embedded font (sfnt) at offset 0x241B5 4324 bytes