Malicious PDF — malware analysis report

Static analysis result for SHA-256 58d01886a068091a…

MALICIOUS

PDF

83.3 KB Created: 2021-04-04 00:26:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: b44aae1dcc80c9a592dd902f5280ea87 SHA-1: f7f689304b85e0ec994b2c35397a6e2fff8743c5 SHA-256: 58d01886a068091acd4ff30adc35a6b2baa06c0b01f086d6731f070628096332
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=latest+adobe+flash+player+for+opera PDF link annotation
    • http://kutatit.getenjoyment.net/how_hard_is_it_to_set_up_a_wordpress_website.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500895/normal_60243bd87301d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392867/normal_6035aaa314c7d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417312/normal_6002c3af22afa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371523/normal_5febd77dc4813.pdfIn PDF document text
    • http://mosuxuvemuzuwex.mywebcommunity.org/tepurimowo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jeromopelurab/microsoft_chess_titans_for_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/puretulenuza/fenns_treasure_chest_found.pdfIn PDF document text
    • https://s3.amazonaws.com/jenisozazewubo/59366986952.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f938a708-55f6-4f3c-8b07-75de2e9a085f/call_of_duty_cold_war_patch_notes_treyarch.pdfIn PDF document text
    • https://s3.amazonaws.com/wikurixobelu/zuturibidojazipipivud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/892ddfa3-0993-403c-95a3-19880164709c/kefaranorajaw.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxenipup/led_zeppelin_houses_of_the_holy_album_cover_art.pdfIn PDF document text
    • https://s3.amazonaws.com/penale/27902109314.pdfIn PDF document text
    • https://s3.amazonaws.com/gebukil/who_is_the_youngest_climate_activist.pdfIn PDF document text
    • https://s3.amazonaws.com/gifojuxaxeva/xudupigujiva.pdfIn PDF document text
    • http://refusunono.onlinewebshop.net/the_fifth_wave_movie_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/fejakixoweka/ka24de_transmission_name.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8977c972-053f-4bf3-9c7c-a8b1cdf115e8/55079290512.pdfIn PDF document text
    • http://peledopa.myartsonline.com/batman_the_killing_joke_download_ita.pdfIn PDF document text
    • https://s3.amazonaws.com/salade/61260089262.pdfIn PDF document text
    • https://s3.amazonaws.com/zoxewudunigus/el_conde_de_montecristo_resumen_por_capitulos_rincn_del_vago.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e6417eb-b200-45d8-a092-daeab1f84d96/97704574069.pdfIn PDF document text
    • https://s3.amazonaws.com/leteraxewe/computer_hardware_tools_examples.pdfIn PDF document text
    • https://s3.amazonaws.com/bejexe/crown_xti_2000_amplifier_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/lawakux/pawalo.pdfIn PDF document text
    • https://s3.amazonaws.com/wolina/minineseruvakilofoxovu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA5D 4948 bytes
SHA-256: 4f2029efa9ddb2df08e8981a5609fe10d0e69d66e5fa7e84c5e0c0ff6e13663f
font_01_sfnt_off00010b44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B44 11196 bytes
SHA-256: 1b64db049d8a40adee0bddffc1c123e2b5ad84bb30b90a2b57d36b0af95bd36d
font_02_sfnt_off00013162.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13162 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2