Malicious PDF — malware analysis report

Static analysis result for SHA-256 56425aa9760504d9…

MALICIOUS

PDF

75.7 KB Created: 2021-04-04 10:32:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6800965974af061660484d2e5a7f009f SHA-1: 2d87de0b6d70fec33d294eef0961ed7a434a12a3 SHA-256: 56425aa9760504d9a5969048cbdb3345c384f0ba06ac161d725e5af9987203d6
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to open a password-protected archive, a common tactic to bypass gateway security. The embedded URL points to a suspicious domain, likely serving as a lure or part of the attack chain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=aprendizajes+clave+primaria+pdf+2020
    • https://cdn-cms.f-static.net/uploads/4401515/normal_602fdc5577494.pdf
    • https://static.s123-cdn-static.com/uploads/4366408/normal_5ff36a95813b1.pdf
    • https://cdn-cms.f-static.net/uploads/4384325/normal_6041724215732.pdf
    • https://cdn-cms.f-static.net/uploads/4528876/normal_5fda8d4c0ca78.pdf
    • http://sugameloxufe.mywebcommunity.org/the_film_experience_5th_edition_audiobook.pdf
    • https://cdn-cms.f-static.net/uploads/4420037/normal_60605a38927a5.pdf
    • http://dajobod.getenjoyment.net/how_do_you_write_a_250_word_essay_about_yourself.pdf
    • https://cdn-cms.f-static.net/uploads/4374698/normal_602be7875fd03.pdf
    • https://cdn-cms.f-static.net/uploads/4422372/normal_60136807813c3.pdf
    • https://cdn-cms.f-static.net/uploads/4448558/normal_6027760a03ace.pdf
    • http://gizovivomiz.getenjoyment.net/96524220939.pdf
    • https://static.s123-cdn-static.com/uploads/4481695/normal_5fe2ac5caaddd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/40aa269d-5227-41a4-8a71-62a00a757b54/agresti_categorical_data_analysis_solutions.pdf
    • http://kebenubes.onlinewebshop.net/videzoxij.pdf
    • https://uploads.strikinglycdn.com/files/dbac5d5a-0375-496b-8aeb-76da97621372/37664445445.pdf
    • https://uploads.strikinglycdn.com/files/73fae4ba-75d2-4636-89aa-619bfa6a556a/26751878634.pdf
    • https://uploads.strikinglycdn.com/files/1bd5083d-7349-478f-b7b9-c7fc3113d72a/zigilirarikep.pdf
    • https://uploads.strikinglycdn.com/files/6ed0f6ea-c4a3-44a4-ab2d-fcc9f515fd89/54052285715.pdf
    • https://uploads.strikinglycdn.com/files/acbbaadf-5ba6-43de-a3b1-e4a042e09697/7180442810.pdf
    • https://uploads.strikinglycdn.com/files/f26a615d-e289-433a-991f-403b7079f0ab/how_to_be_an_effective_team_leader_at_work.pdf
    • https://uploads.strikinglycdn.com/files/3fba4b65-b69f-4967-8ea0-59958aa1c6e4/electrical_technician_interview_questions_and_answers.pdf
    • https://uploads.strikinglycdn.com/files/a8eec8f2-e3a6-4fd4-abdb-429d22641b0c/motorola_baby_monitor_mbp33xl_extra_camera.pdf
    • https://uploads.strikinglycdn.com/files/e6c975c3-8f5a-415e-902a-a5e00db07138/fusurewonejimofekeso.pdf
    • https://uploads.strikinglycdn.com/files/d4ce3497-fe6c-42ad-9c8a-7f3551d1dd78/36180782879.pdf
    • https://uploads.strikinglycdn.com/files/1b4d9943-b5c3-42b7-b13e-5e1adb33cd27/kosulavujedowuxidevami.pdf
    • https://uploads.strikinglycdn.com/files/b3726e81-46e0-436a-9bdd-85778a0c941a/tusolipurosixaku.pdf
    • https://uploads.strikinglycdn.com/files/fdcbf08f-0213-4432-baf9-44b3ee8b9a57/barilexeloredogalar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e43b.bin
39798c7df51593c3d3a6291b298d8bd5cf55f412f9bc402f58f49b500ad8052a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE43B 5752 bytes
font_01_sfnt_off0000f7ce.bin
1859b37dc64cf6a7711c490e5dffac02afc7281b446bfdfb730e602ab759c706		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7CE 11984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.