Malicious PDF — malware analysis report

Static analysis result for SHA-256 54fa637eae7f2525…

MALICIOUS

PDF

83.4 KB Created: 2021-04-04 08:32:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 52241ee0a6af6183d97bcc6f8103840b SHA-1: ecfadefb749088d6f5f52d4a2a778e99388565ba SHA-256: 54fa637eae7f25256427c4821288c2c45221e4ee33b1594d263ccc59d4b9a3ec
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and is flagged by a machine learning classifier and ClamAV as malicious phishing content. The embedded URL, 'https://dafemum.ru/strik?utm_term=first+alert+standard+home+fire+extinguisher+expiration+date', suggests a phishing lure related to fire extinguisher expiration dates. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs are indicative of a phishing attempt, likely leveraging embedded JavaScript for malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=first+alert+standard+home+fire+extinguisher+expiration+date
    • http://mirror-x.org/ronovegimurusagenokitqpgeg.pdf
    • http://meetdouche.xyz/lutobinituxelaxiw3vqe.pdf
    • http://znatural.space/xepan3tapk.pdf
    • https://cdn-cms.f-static.net/uploads/4367944/normal_6024913de679c.pdf
    • http://cooldomen.space/aaha_naa_songsmlsxk.pdf
    • https://static.s123-cdn-static.com/uploads/4426261/normal_5ff29eecc78b9.pdf
    • https://cdn-cms.f-static.net/uploads/4448750/normal_6041f21c5f511.pdf
    • http://zathkatow.xyz/baralufenilubaxkzwjo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/makixibawumebol/microsoft_sculpt_ergonomic_wireless_keyboard_and_mouse_set.pdf
    • https://s3.amazonaws.com/timeziso/90819801298.pdf
    • https://uploads.strikinglycdn.com/files/1ad9af5d-816c-41c4-9f3b-bae798d51ea3/how_much_was_andy_griffith_worth_at_his_death.pdf
    • https://uploads.strikinglycdn.com/files/3ceb5eef-dfbd-4019-9b3c-abee7d191ec9/mulanemakuzezidole.pdf
    • https://uploads.strikinglycdn.com/files/64fc7122-93dc-43b9-96d2-5c004965970d/clear_google_search_history_computer.pdf
    • https://uploads.strikinglycdn.com/files/930763ff-4af2-4a59-9a04-a92bef7bc5fa/42290216022.pdf
    • https://uploads.strikinglycdn.com/files/1712e2a5-1a2d-4443-9259-33cbe08a75d1/33452382894.pdf
    • https://s3.amazonaws.com/woneketelak/chicago_annotated_bibliography_example.pdf
    • https://s3.amazonaws.com/xulepiwa/17423004933.pdf
    • https://uploads.strikinglycdn.com/files/31f0d6f0-933d-4267-83dc-7dcd58a660fb/my_papas_waltz_poem_annotated.pdf
    • https://s3.amazonaws.com/senodiw/redefining_realness_review.pdf
    • https://s3.amazonaws.com/gurowozenupifi/66314969945.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105a6.bin
2fdd5f872b53c1ff9854a3d7d197e30cd35bda6b21f23962755491a05f4e79df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105A6 5476 bytes
font_01_sfnt_off00011827.bin
d34590e15e22cb6ae9b19f11f1494dcf7ac52d501fd1fd6a1aeb7a1abab7eebf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11827 11252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.