Malicious PDF — malware analysis report

Static analysis result for SHA-256 5af3aedbc98f04f4…

MALICIOUS

PDF

75.2 KB Created: 2021-03-24 08:48:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 3f41bb4e4af3159d68c1dfb6d7b9db38 SHA-1: e381520841fee754b5f1668f7b8d60eecc57b82d SHA-256: 5af3aedbc98f04f4d951f83e0a6d835faa6a59bb39a693246dfa48c67c508ecd
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or malware delivery attempt. It contains invisible links that redirect to external URLs, one of which is a CAPTCHA-themed lure. The presence of these links suggests an attempt to trick users into interacting with malicious content or providing sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=where+was+stephen+king%2527s+the+stand+filmed PDF link annotation
    • https://cdn.sqhk.co/vuvupewog/jdhdig9/gafapoxevolubamederad.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376371/normal_60377e7f20f4e.pdfIn PDF document text
    • https://cdn.sqhk.co/totimujid/9XiiWji/66752009947.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422145/normal_5fce8bd310719.pdfIn PDF document text
    • https://cdn.sqhk.co/wanoposuj/xCjidgi/temple_run_3_game_video_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dogazisuze/blank_army_certificate_of_achievement_template.pdfIn PDF document text
    • https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_73e1260ee8124523bcac8d2b3b4d1e7a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rewepalazamiso/wedajegidanivemimi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/634d6eef-3a2e-46b8-ba23-d0d25d1d4477/falcon_bms_system_requirements.pdfIn PDF document text
    • https://s3.amazonaws.com/tumasun/captcha_background_images.pdfIn PDF document text
    • https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_55ce06005a804087885c21f1e3eb99d3.pdf?index=trueIn PDF document text
    • http://lufubafuma.epizy.com/which_hedge_funds_beat_the_market.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1551afd4-d899-431e-82cf-d0fbbb5c2dc5/3065868042.pdfIn PDF document text
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_79ff53fc468b4312a644fde87bd8ff76.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f48bcabb-aa92-4056-a318-1c75ef3f8996/sentence_structure_meaning_and_examples.pdfIn PDF document text
    • https://s3.amazonaws.com/wovisak/canabalt_descargar_para_android.pdfIn PDF document text
    • http://gobonelore.epizy.com/fisabiteja.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e62e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE62E 5656 bytes
SHA-256: 444fd99dc56937e59594fb8e07b99c44e59f86c3e88a84e31fd4b1396c16fc82
font_01_sfnt_off0000f96b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF96B 11404 bytes
SHA-256: c7192c2b6f5e2961361417cc72d86cb0c1ef2028eab60107e1913ef7a104c402

Open this report in the interactive analyzer, or submit your own file for analysis.