Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c0325e135c53fd5…

MALICIOUS

PDF

71.3 KB Created: 2021-04-10 12:57:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2e52572dd58d49ac344503e18e8c03f8 SHA-1: 762756abdfb4c3ca00b5bf82e9941373689f78f4 SHA-256: 5c0325e135c53fd5cb1e187c8dac64b21655a5c53d1b222f2389c989ced4364d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and is flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The embedded document body, though heavily obfuscated, contains text related to 'Honda activa 110cc engine oil capacity', suggesting a lure to a malicious URL. The presence of external URIs and the overall detection profile point towards a phishing attack delivered as a document attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=honda+activa+110cc+engine+oil+capacity
    • https://cdn.sqhk.co/gogojelawov/4hajcL0/dujegajugemomab.pdf
    • https://cdn.sqhk.co/lasokixon/VwSjhgI/9109978076.pdf
    • https://cdn.sqhk.co/dizoketa/ksLhdha/bengali_movie_song_sathi.pdf
    • https://static.s123-cdn-static.com/uploads/4476150/normal_5fdf3b29bb0ce.pdf
    • https://static.s123-cdn-static.com/uploads/4410730/normal_5fdd3405c8bea.pdf
    • https://cdn.sqhk.co/numobelez/1hejee9/bullfight_dance_form.pdf
    • http://xufopizaxeto.medianewsonline.com/mupamakuk.pdf
    • https://cdn-cms.f-static.net/uploads/4405197/normal_600a9923e3aaa.pdf
    • https://cdn-cms.f-static.net/uploads/4370767/normal_605f1a3b860c6.pdf
    • http://gojawufeki.getenjoyment.net/connecticut_dmv_bill_of_sale.pdf
    • https://cdn-cms.f-static.net/uploads/4496165/normal_60137680441c8.pdf
    • https://cdn-cms.f-static.net/uploads/4416921/normal_603fde5154468.pdf
    • https://cdn.sqhk.co/gufojakig/jagehf3/high_sea_saga_cheat_free_download.pdf
    • https://cdn-cms.f-static.net/uploads/4482215/normal_60133e6e3bd48.pdf
    • https://cdn.sqhk.co/gizulakofo/gehejh1/menajenizavujatinutikin.pdf
    • https://cdn.sqhk.co/gulifunanale/YjjKhgp/zimajedivawudojuwo.pdf
    • https://cdn.sqhk.co/lokabawopup/ieBzGp8/world_cup_2022_qualifiers_mexico.pdf
    • http://rinotox.iblogger.org/aschenputtel_by_the_brothers_grimm.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fevepapowiwed.epizy.com/mozafepoguzu.pdf
    • http://gukupexokopiwug.epizy.com/38761204725.pdf
    • http://ganesuk.epizy.com/juzaximolapezezokitidu.pdf
    • http://wutorokanotomav.onlinewebshop.net/jolosuxaxuna.pdf
    • http://wozawexopad.epizy.com/molijofukugeworijutorodu.pdf
    • http://bujijawuta.atwebpages.com/logical_intelligence.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd0a.bin
a0b8dcde2fd4feaccca3f51894545eab39498d203f76ef49e3ec0ce87b9a629a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD0A 5284 bytes
font_01_sfnt_off0000ef2a.bin
4b85057338215542032441388e326735be15b992740ba7583df6fd5b407867a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF2A 9516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.