Malicious PDF — malware analysis report

Static analysis result for SHA-256 54f5c832ce45c4c4…

MALICIOUS

PDF

71.6 KB Created: 2021-03-29 12:27:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bff4a0a54db36ac1a43f9e8aeb37b1f7 SHA-1: 77a9ad175156326c38a78e3f33689c8443138726 SHA-256: 54f5c832ce45c4c4593f9695bfb0a99efed2e6171f8c6f1a0b315edb4bedc888
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains embedded URLs, with one prominent URL suggesting a lure for a movie download. The presence of PDF_URI and EMBEDDED_URL heuristics further supports the phishing attempt. No scripts were extracted, but the overall structure and embedded URLs point to a malicious document designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=dushman+duniya+ka+full+movie++720p
    • http://distornyup.site/world_conquest_war_strategytv14e.pdf
    • http://magnifioco.site/zibovepabebonin7lxpo.pdf
    • http://feelslike35.com/balochi_dance_video83obw.pdf
    • https://static.s123-cdn-static.com/uploads/4454048/normal_5fee12709e465.pdf
    • https://static.s123-cdn-static.com/uploads/4474736/normal_5feb45e737944.pdf
    • https://cdn.sqhk.co/kivipemo/yUjhOie/kidafodalatariforinoporeb.pdf
    • https://cdn.sqhk.co/gepaxulunan/EiaIbij/short_information_about_football_in_marathi.pdf
    • https://cdn-cms.f-static.net/uploads/4475570/normal_6031f38327190.pdf
    • http://pedron.fun/48779609641aqqaf.pdf
    • http://lapitubemexidi.mywebcommunity.org/bulisegeledes.pdf
    • https://cdn.sqhk.co/kubarevopew/hjheLif/nitipaxotojotilolobazuw.pdf
    • http://wemuwetafivaxe.sportsontheweb.net/how_to_reset_a_amazon_smart_plug.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/167bb28c-4722-4d34-8210-12f75c47b39e/que_es_la_palabra_justo_en_la_biblia.pdf
    • https://uploads.strikinglycdn.com/files/b3698568-1194-4322-b48a-868d0243dae9/stm32f4_reference_manual.pdf
    • https://uploads.strikinglycdn.com/files/40d2506a-18e1-4238-9544-c09d88c475cc/how_much_sugar_in_dunkin_donuts_creamer.pdf
    • https://uploads.strikinglycdn.com/files/587c03aa-3605-4898-b084-1ec7f3af8b14/segabegikorotexifejewopo.pdf
    • https://uploads.strikinglycdn.com/files/f53b343c-4d48-47fa-a01f-da3ecf0a0e8f/libro_de_fisica_2_secundaria_infinita_completo_contestado.pdf
    • https://uploads.strikinglycdn.com/files/568f4d8d-022b-4007-bfca-a39673f824d0/65163898923.pdf
    • http://segurixuzek.myartsonline.com/automobile_engineering_r_k_rajput_download.pdf
    • https://uploads.strikinglycdn.com/files/44c908e1-a39b-463a-a86c-1940f0c162bc/fuwofizalifasogu.pdf
    • https://uploads.strikinglycdn.com/files/b7f428d8-0e03-4672-87d9-6897169d6c17/64768404044.pdf
    • http://pozidijapepore.atwebpages.com/is_1400_a_good_sat_score_for_ucla.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d83d.bin
ffa749fa8c9a83a0c904af420270983c3738de885361d597775e3cecec467a4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD83D 5764 bytes
font_01_sfnt_off0000ebd5.bin
718c9b51c6b8b92588b8b57b1efd73af41de8bdfcd4d160c3b5071ae0389763f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBD5 10932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.