Malicious PDF — malware analysis report

Static analysis result for SHA-256 5389e29dd0c4f87f…

MALICIOUS

PDF

202.7 KB Created: 2017-11-07 23:28:06 +02:00 Authoring application: www.convertapi.com
MD5: faa9c60fa22c93f4ee00a4e7641458fe SHA-1: 510a3f6284823d468a7b97948bfc61b1a7b60884 SHA-256: 5389e29dd0c4f87f02543ca4c687e36e8e53a7f6595a63237e0f755157b045ae
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF is identified as an image-only lure, containing minimal text and a clickable action designed to redirect the user to an external URL. The ML classifier strongly flagged this PDF as malicious. The primary IOC is the external URI pointing to a suspicious webhostapp domain, which is likely used to host a malicious payload or phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8936

Heuristics 4

  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 2 text block(s), carries a click-outward action, and is only 202 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://383747434.000webhostapp.com/error.php
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off0000059a.bin
ecba12aaa0ec5c45a6edb9d2e041ca8334945da74f4d14575a7dd7fe7948bfa9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x59A 181236 bytes
stream_002_off00015224.bin
f3bf9704ae1a1b01d6eaba8c4203245dfddd8957cdd25f52cca46afe823164ba		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15224 173484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.