Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ae98cfe1c98488e…

MALICIOUS

PDF

78.1 KB Created: 2021-06-05 21:59:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ab685a02ea905245347b58caaaa76399 SHA-1: f419b3cf4ba8ec6811f3b78831e8c351451ca3b6 SHA-256: 5ae98cfe1c98488e0c97ef466741385f4464a8c56e2e6546bd6b902345c6cf26
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to a suspicious domain, likely intended to host or deliver a malicious payload. The document body, though heavily obfuscated, suggests a lure related to an 'annual report', and a heuristic detected a visual download button, reinforcing the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=annual+report+garuda+indonesia+2017+pdf
    • https://xutogimumunode.weebly.com/uploads/1/3/4/3/134375265/dosuk.pdf
    • https://wuwivuwo.weebly.com/uploads/1/3/7/5/137504369/6082d78553503a0.pdf
    • https://soberoxafig.weebly.com/uploads/1/3/4/3/134319442/levit_gofunopox.pdf
    • https://judiwexip.weebly.com/uploads/1/3/4/5/134517798/40c93df8e148ed.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f03a3c04-1716-42e6-a3ef-24f2ddbd7fb3/purutipenulovameresawek.pdf
    • http://niwomif.pbworks.com/f/xofulagebedevir.pdf
    • http://fatakalewene.pbworks.com/w/file/fetch/144503409/kamen_rider_ryuki_the_movie_episode_final_sub_indo.pdf
    • http://zixereves.pbworks.com/f/faroger.pdf
    • http://wefolevemud.pbworks.com/w/file/fetch/144625698/toxibilo.pdf
    • https://uploads.strikinglycdn.com/files/455ab010-d3fe-45ad-a5b7-7a59dffb9a04/playing_card_club_symbol.pdf
    • http://zepupifob.pbworks.com/f/19324251309.pdf
    • http://mevuteled.pbworks.com/w/file/fetch/144547335/download_raft_wars_hacked_online_games.pdf
    • http://nilanom.pbworks.com/f/como_agua_para_chocolate_english_translation_chapter_2.pdf
    • http://zegakodas.pbworks.com/w/file/fetch/144658017/8718472080.pdf
    • https://uploads.strikinglycdn.com/files/9cf25c01-d9c6-4b7a-936d-49c4e25004b9/how_to_get_rid_of_skinny_arms_male.pdf
    • http://fufitiruw.pbworks.com/w/file/fetch/144568662/english_grammar_papers_with_answers.pdf
    • https://uploads.strikinglycdn.com/files/3d767cae-4ea4-4576-ba09-2e1455573675/kenmore_70_series_dryer_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/b28d5944-e77a-4e90-9e6b-47d2664cdbcf/57859661361.pdf
    • http://negaboxa.pbworks.com/f/2d_and_3d_shapes_activities_for_grade_1.pdf
    • http://wikitaxif.pbworks.com/w/file/fetch/144580506/mamod_steam_engines_for_sale_uk.pdf
    • http://xuwuziz.pbworks.com/w/file/fetch/144512916/the_mummy_full_movie_hindi_dubbed_download_480p.pdf
    • http://nikekuva.pbworks.com/f/cells_and_their_organelles_answer_key.pdf
    • http://finatin.pbworks.com/w/file/fetch/144569481/50145464959.pdf
    • http://tukufidanega.pbworks.com/w/file/fetch/144628149/wrestling_revolution_3d_wwe_mod_apk_download_for_android_mobile.pdf
    • http://xuruzinijub.pbworks.com/f/25858250845.pdf
    • http://nagomax.pbworks.com/f/76429074246.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f397.bin
2304858c3f2c36321c2b21ddf6a9225df00764f36b542b6e83993ecb5fe46ede		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF397 5604 bytes
font_01_sfnt_off000106c5.bin
2ee0af1d5059a9898768b0fc3bfc0e632b007c7cfe247169de9bd54188715992		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106C5 10656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.