Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c12ea11caf68945…

MALICIOUS

PDF

85.4 KB Created: 2021-04-02 13:10:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b88c0d34fc61bf047b767e1a6981d02f SHA-1: 746c3cd6dadeb88906fddb7e8c78299e26a5b1f1 SHA-256: 5c12ea11caf68945357be04d6b304ad333000a1759fe277ef7486bc1ee85b066
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of external URIs and a visual download button suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a URL that aligns with the PDF_URI heuristic, further supporting a malicious download lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=o+poder+da+kabbalah+yehuda+berg+pdf+download
    • http://b0xberry.online/how_to_make_a_face_mask_with_filter_pocket_and_nose_wire_youtubez2fw6.pdf
    • https://goreduve.weebly.com/uploads/1/3/2/7/132740848/9426827.pdf
    • https://duwaratax.weebly.com/uploads/1/3/4/6/134621450/407769.pdf
    • http://rcasino.info/736881569920bhj7.pdf
    • https://lobubanir.weebly.com/uploads/1/3/2/8/132814664/9665c48de723.pdf
    • https://cdn.sqhk.co/sotatixorawi/jiKhihc/wheels_on_the_bus_super_simple_2019.pdf
    • http://hangzhoumetal.ru/87292149004fg64j.pdf
    • http://fuwenosod.iblogger.org/apple_airpods_microphone_android.pdf
    • https://cdn.sqhk.co/sunomedude/hiEEpgg/vemedomokavujavotobixu.pdf
    • http://domavera.ru/44341622767rw8oo.pdf
    • https://cdn.sqhk.co/numiwuzuwix/idLgajg/yandex_disk_apk_uptodown.pdf
    • https://netukilegulises.weebly.com/uploads/1/3/1/6/131606016/rejipuzaxoma.pdf
    • http://visiblawty.com/rezirevuxorexeslhdj8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/14419420-a53d-4371-8b78-cfcc9385118c/jelijeritajowufosovurelu.pdf
    • http://gavemuvivagezed.epizy.com/integrated_chinese_textbook_level_1.pdf
    • https://s3.amazonaws.com/supefujoxopubu/49709885420.pdf
    • https://s3.amazonaws.com/bibejovixapis/uma_chakravarti_brahmanical_patriarchy.pdf
    • https://s3.amazonaws.com/mijumomub/39695326844.pdf
    • http://popuzavefigud.epizy.com/98369986529.pdf
    • https://uploads.strikinglycdn.com/files/401e91e9-282c-4e85-b6ef-a8fc4fd84aee/is_ap_physics_1_exam_hard.pdf
    • https://s3.amazonaws.com/fifuto/bang_bang_movie_telugu_audio_songs.pdf
    • https://s3.amazonaws.com/makumapikeze/79847109570.pdf
    • https://uploads.strikinglycdn.com/files/de9d66ec-7311-4117-88f3-e155cc676620/57847563961.pdf
    • https://uploads.strikinglycdn.com/files/0746004a-30da-4caa-9483-9ab5eeff6cec/zetipewolemiwalodevagobop.pdf
    • http://zeluzara.epizy.com/stephen_king_it_chapter_2_ending.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000108ab.bin
a1f3f93bc748c791bd539fc83a991e5e59bba5d6416415e88e09d8137df362e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108AB 5552 bytes
font_01_sfnt_off00011b9d.bin
f94e5027d56a91fd68af7dfdb571f80dfd271edf62a6b675904b96a26affcec2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B9D 14896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.