Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b610473fcd0a4fb…

MALICIOUS

PDF

73.4 KB Created: 2021-04-02 07:00:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 966991f5a06d3ed0321d88e2f4f5449c SHA-1: d1d59a175c69be3a520a7eef562ea8dd387d57c3 SHA-256: 5b610473fcd0a4fbfb7aaa4d057ba05deda2a866099f0392995e2b33f5f9a6c9
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, and it contains an external URI pointing to a suspicious domain. The document body, though heavily obfuscated, suggests a lure related to an 'Allahabad high court aro answer key pdf', indicating a phishing attempt. The presence of embedded URLs and the overall context strongly suggest a phishing attack designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=allahabad+high+court+aro+answer+key+pdf
    • https://cdn.sqhk.co/mofijovelu/QhbpheA/thinking_skills_inventory.pdf
    • http://narulifiduguzez.iblogger.org/business_turnaround_strategy_steps.pdf
    • https://cdn.sqhk.co/jadepibake/xjfQMbq/55507632966.pdf
    • https://cdn-cms.f-static.net/uploads/4491426/normal_6040a2ff4bf5d.pdf
    • https://cdn-cms.f-static.net/uploads/4392853/normal_603751583df70.pdf
    • http://dufasobogunojat.22web.org/merriam_webster_dictionary_free.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xewamejixolefaj/bhai_punjabi_song.pdf
    • https://ad646471-8556-449a-8150-55a6f6ff724f.filesusr.com/ugd/7a1c5b_05548f4dc9bf4425a9b9df1dd578ea72.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ddd088c5-7134-4965-9a89-118bd41c95db/xopefoge.pdf
    • https://8dcf3d85-40eb-4350-b789-ae6ac2c46e24.filesusr.com/ugd/21d17a_bd109b6ebdb74fcd8ad2c2d8188a5de7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/51259d4d-7b9e-45f5-b42e-03858feadd79/what_is_ticker_symbol_for_sp_500.pdf
    • https://e6676b24-921d-4f57-8fca-beda98688f3c.filesusr.com/ugd/144d27_29ffdb9de13741f08e48a906f3bbe55d.pdf?index=true
    • https://932aa67c-856a-4fda-9fc8-fe3f50d4acc2.filesusr.com/ugd/a25eee_b86864e2ea004ad496db55766dd414e6.pdf?index=true
    • https://s3.amazonaws.com/genukopapovixo/14236041107.pdf
    • https://fe92b815-f0fe-4223-924b-659339f44b90.filesusr.com/ugd/8f64fc_6b53527acfe946a482d4c662e1a4d23c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bdda896e-6b1e-48e7-9e63-0e31740b812f/1073065954.pdf
    • https://uploads.strikinglycdn.com/files/32b9821c-b9ba-42e0-ae88-c80a5cc37a01/zovubaz.pdf
    • http://xibigenoz.rf.gd/calligraphy_book_michaels.pdf
    • https://s3.amazonaws.com/saxefi/news_reporter_salary_aaj_tak.pdf
    • https://s3.amazonaws.com/rupatojuko/is_twilight_midnight_sun_on_netflix.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de30.bin
3104592d12a73c7f6b87da21bf9c76b0d84806c8713951a80780062d7a568029		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE30 5804 bytes
font_01_sfnt_off0000f200.bin
c3327a921f3873f1d54ecedadfb93967b4f713461ca07e1516291ec6299d3810		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF200 11244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.