Malicious PDF — malware analysis report

Static analysis result for SHA-256 54d4ad937e83d664…

MALICIOUS

PDF

75.9 KB Created: 2021-04-25 01:09:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6cdc80f0a6f43c8a91cc7ee70a900913 SHA-1: 7820cb7bf9d1107b57ba5b35c1a6f6bee3fbdeb1 SHA-256: 54d4ad937e83d6645803a2869e536fb608807e1fceb569bdab65c48c58db2427
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site for further exploitation. The document body, though partially corrupted, suggests a lure related to 'SAP WM training in Pune'. No scripts were extracted, but the presence of external URIs and the overall detection suggest a phishing attempt to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=sap+wm+training+in+pune
    • https://zexejofamimow.weebly.com/uploads/1/3/1/4/131438337/2105738.pdf
    • https://binezorimitujux.weebly.com/uploads/1/3/4/3/134337637/jivegasifovi.pdf
    • https://damenuxorofupob.weebly.com/uploads/1/3/4/7/134711178/4659672.pdf
    • http://nukicew.xyz/ficha_de_almacen_plantillani2zt.pdf
    • https://static.s123-cdn-static.com/uploads/4455672/normal_60004a271cd99.pdf
    • http://feedbacrnz.space/93573405246id2al.pdf
    • http://remontvorot24.com/jomuxeforuygth4.pdf
    • http://edevletorg.com/what_is_the_compensation_for_being_on_judge_judy3o1cl.pdf
    • https://fusofajo.weebly.com/uploads/1/3/1/4/131438110/7187111.pdf
    • https://mimatetozolo.weebly.com/uploads/1/3/4/7/134707120/wusojot-tazofenolu-mujokodele.pdf
    • https://static.s123-cdn-static.com/uploads/4479454/normal_5fe3ec00129c4.pdf
    • https://timifuxi.weebly.com/uploads/1/3/4/6/134676324/gafuzil_xibafinosesavu_jivuxogumozin_pukigefifarawo.pdf
    • https://cdn-cms.f-static.net/uploads/4455672/normal_602735831622b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vobuturinivi/andrea_bocelli_si_album_free.pdf
    • https://s3.amazonaws.com/bibejovixapis/tijujujoxelekal.pdf
    • https://s3.amazonaws.com/libowebujakux/lash_extension_training_cost.pdf
    • https://s3.amazonaws.com/mizeteb/badnaamiyan_mili_female_version_song.pdf
    • https://s3.amazonaws.com/fulosobezur/bolton_macmillan_cancer_information_and_support_service.pdf
    • https://s3.amazonaws.com/bakoloj/276999554.pdf
    • https://s3.amazonaws.com/somisilegex/jewigujufevip.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d754.bin
1e2a9779c6323e3f970e3cd511331fc8438f070e13830432f7d1a14926fb172f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD754 5124 bytes
font_01_sfnt_off0000e8bf.bin
30ac672ccdc5f943d71dbc816ba531445e835dd623e0249236c418a10feaccd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8BF 10656 bytes
font_02_sfnt_off00010d5d.bin
6e3fbd491d8b71441998836ddca0d0c102716a221ea14f8143929167ad9a79b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D5D 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.