Malicious PDF — malware analysis report

Static analysis result for SHA-256 52ed4fefaa2acdf8…

MALICIOUS

PDF

78.3 KB Created: 2021-04-06 15:58:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 780c95683fd988ac6829aca1c812f315 SHA-1: b41411847a8fcee3715d3d104dd64b503d92b7f4 SHA-256: 52ed4fefaa2acdf86326d2f00b633fcb65b4364e20342436d77a835f030b8767
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicates the document likely contains instructions to decrypt or access a password-protected archive, a common tactic to evade gateway scanning. The embedded URL and numerous other extracted URLs suggest a phishing or malware distribution attempt, likely related to device support or troubleshooting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=how+to+reset+foscam+fi8918w+to+factory+settings
    • http://pinenud.mygamesonline.org/gikowomugajipaba.pdf
    • https://viwezoluzuwa.weebly.com/uploads/1/3/4/4/134401695/dodipipozigidamaput.pdf
    • http://pressit.space/zisofosoburotilb795v.pdf
    • http://particulier-societegenerale.xyz/kebeminu53h.pdf
    • http://womenit.space/puwekumefijatrgo.pdf
    • http://birabaguperije.iblogger.org/industrial_biochemistry_books.pdf
    • https://dexulivixuwe.weebly.com/uploads/1/3/0/7/130739852/punalakafamara-fetuwozibake-riposem.pdf
    • http://gooddevice-online.com/lord_of_the_rings_theme_piano_sheet_music_freeh2u1f.pdf
    • http://vipadminler.org/42489700267nxlte.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fejetowetut.rf.gd/keto_diet_easy_meal_plan.pdf
    • https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_5609766113de4421b80fd75e764ff9bc.pdf?index=true
    • http://rodexiguv.onlinewebshop.net/how_to_reset_haier_refrigerator.pdf
    • http://tiluxusimutine.atwebpages.com/what_does_de_nada_mean_in_portuguese.pdf
    • https://83d12552-0bc1-4415-b221-1da25caacb9b.filesusr.com/ugd/1e11d0_9509d26a6f0843698e6c85aaa328ea69.pdf?index=true
    • https://c8070bf9-ed42-4c5d-8eb8-ca35ee70f136.filesusr.com/ugd/d38238_a5df8934e83840b18d531230b0f75029.pdf?index=true
    • http://pejemevogoge.myartsonline.com/cambridge_latin_book_2.pdf
    • http://lugirike.epizy.com/86176612404.pdf
    • http://bosewavim.rf.gd/micromax_android_hard_reset_code.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f34f.bin
8165ed364538e8e586240319d0d1878692d0246858c298d18cbaa017669df038		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF34F 5728 bytes
font_01_sfnt_off000106d7.bin
56532bafb73133e411a910170b715c3ef7db96a7e530ce422dec504297fac040		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106D7 10892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.