Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c9ac6ee338a0000…

MALICIOUS

PDF

634.9 KB Created: 2021-04-06 14:06:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11a0522e9a3c5ac1fa20376c2bf92cc7 SHA-1: 3a49a5e358bab6f01d4584d7c537b87bf386648a SHA-256: 5c9ac6ee338a0000e0929c1450fb5628bcddb31d83f44876a540d863d399a244
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV with a critical heuristic firing. It contains an embedded URI pointing to a suspicious domain, and multiple other URLs that could be part of a phishing or malware distribution campaign. The presence of a 'callback phishing phone lure' heuristic suggests a social engineering attempt to trick the user into calling a fraudulent number.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4318

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/aws?utm_term=how+to+take+devils+ivy+cuttings
    • http://rofuxipof.mywebcommunity.org/diego_azqueta_economia_ambiental.pdf
    • https://fadefewili.weebly.com/uploads/1/3/4/3/134316521/6662501.pdf
    • https://static.s123-cdn-static.com/uploads/4451753/normal_5fe1b4126bec4.pdf
    • http://jafebidit.getenjoyment.net/video_aula_de_ingles.pdf
    • https://tiwebusimevadeb.weebly.com/uploads/1/3/5/3/135346158/gebevinevetebexis.pdf
    • http://vuzuwul.getenjoyment.net/tuwikot.pdf
    • https://rizimajapalikum.weebly.com/uploads/1/3/4/6/134633575/55dbf6932.pdf
    • http://kogutojoveso.mywebcommunity.org/xonusaxenikelepiw.pdf
    • https://cdn-cms.f-static.net/uploads/4374984/normal_5fd8333194223.pdf
    • http://jirenaxapibetig.scienceontheweb.net/9147016548.pdf
    • https://kelogukagikuval.weebly.com/uploads/1/3/0/7/130739039/7612582.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://fedorahosted.org/lohit
    • https://054d5c26-596f-48a3-87a7-0fc79031e5db.filesusr.com/ugd/599026_b14fd8379105406fa7b1a5ec87391a7f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b02637ba-f67f-4554-8ca1-63accbb8a8e4/how_to_fix_a_squeaky_dryer_belt.pdf
    • https://uploads.strikinglycdn.com/files/93e1f948-eb09-4793-b40f-bbd9c4421490/91263707638.pdf
    • https://uploads.strikinglycdn.com/files/5fc4e69c-a46d-44d8-bb44-212e1e5bf7d8/learning_python_powerful_object-oriented_programming_download.pdf
    • https://uploads.strikinglycdn.com/files/75570f4e-d1f2-4da6-98d8-efe4132ca9d2/cloud_9_movie_2006.pdf
    • https://6baea7ca-81e4-4a11-8410-716433a99462.filesusr.com/ugd/764aaa_379a66807dfe4bd4b48b96034ea2e4b1.pdf?index=true
    • https://f1cb2ec4-a82d-4768-8a06-5236a2db220e.filesusr.com/ugd/a2e20a_2cff599d62ba4351a6495eb632f25100.pdf?index=true
    • https://uploads.strikinglycdn.com/files/66d509b7-1eb4-4fb9-9ce0-ceb6049a08ed/why_does_my_electric_oven_not_work.pdf
    • https://uploads.strikinglycdn.com/files/b519c976-9c5d-4a60-9d42-a7934252118f/analects_of_confucius_list.pdf
    • https://3bcdeb60-9876-4d14-bc0a-1dd1632c647c.filesusr.com/ugd/16a96a_bf4414c7921545c296dd9a3b3c2291bb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_012_off00099426.bin
d4feaa46049f7da3dbb2880712ccb42f5da1d5c7c63ece6fe305b399dc3e3a00		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x99426 17836 bytes
font_00_sfnt_off00088a13.bin
183fec9881e3bc5df37df90814e341bbed11facd6563458e0caf44cdb4c71574		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88A13 51444 bytes
font_01_sfnt_off000927e6.bin
e479057a12f749fcf5753989a83b1e5ec4c3a2ac948c13606a8ce926ca6e6b7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x927E6 5172 bytes
font_02_sfnt_off0009396d.bin
7fd505bf7073491edcedb9a603b579ab86b0289869008c5b190c5ad29732ee1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9396D 5176 bytes
font_03_sfnt_off00094aca.bin
7d103a6660978e53dcd4d8510d2e332c1d8b4f001bf456009c435fb5741fe185		 pdf-font-stream PDF embedded font (sfnt) at offset 0x94ACA 24632 bytes
font_05_sfnt_off0009afd9.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9AFD9 4324 bytes
font_06_sfnt_off0009bde3.bin
126935420cbce32b4f85189d47de528866e06392de48a3a5ced8c22527665000		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9BDE3 3168 bytes
font_07_sfnt_off0009ca58.bin
728c53d4ab0621e4d96fe80ffde95e12c2b9960e6b29324e06326209992319fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CA58 6092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.