Malicious PDF — malware analysis report

Static analysis result for SHA-256 5cfdce31167bd7f0…

MALICIOUS

PDF

139.4 KB Created: 2021-03-29 12:18:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 917b973768826716d66c3cb52a26fad9 SHA-1: 5e1668c418791da522a9439217fda23896f70b87 SHA-256: 5cfdce31167bd7f0646763a80bf78d1dc8af4de8a21685238555432bf242b9b2
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The 'SE_ENABLE_LURE' heuristic indicates the document likely attempts to trick the user into enabling macros or editing, a common tactic for malware droppers. The embedded URL suggests a potential download or redirection to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=file+pdf+kh%25C3%25B4ng+highlight+%25C4%2591%25C6%25B0%25E1%25BB%25A3c
    • http://petajofap.22web.org/king_size_quilt_sets_with_sheets.pdf
    • http://fisidunetozusi.iblogger.org/tawirizolizenevetusevo.pdf
    • https://cdn-cms.f-static.net/uploads/4501484/normal_60345bc0c1623.pdf
    • http://botumizesakukij.iblogger.org/mapa_do_mundo_paises.pdf
    • http://kuzexamipapoxip.medianewsonline.com/nutrition_facts_taco_bell_bean_burrito_no_cheese.pdf
    • http://minesaxofunawi.getenjoyment.net/76977754848.pdf
    • http://vazifesi.iblogger.org/laxipajedigaparomiju.pdf
    • https://static.s123-cdn-static.com/uploads/4376599/normal_5ff95918d3a83.pdf
    • http://bevurib.22web.org/the_intermediate_spreadsheet_proficiency_with_microsoft_excel.pdf
    • http://sorulaxawo.iblogger.org/wuxujoluwuwimududug.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tebalakafepikob.rf.gd/el_conde_de_montecristo_pelcula_completa_en_espaol_latino_2002_hd.pdf
    • https://s3.amazonaws.com/boxalewijim/copernic_desktop_search_portable.pdf
    • https://s3.amazonaws.com/dosipive/powowolakadabepajegaje.pdf
    • https://df1882fa-13c5-42f1-8438-577935b594b9.filesusr.com/ugd/91932b_1a364aafdedc49b29dd8f47226c853e9.pdf?index=true
    • http://bafuwujix.atwebpages.com/attestation_pole_emploi_cesu_vierge_2020.pdf
    • https://7d6e376e-1ee3-4df5-88c1-8d1511d419f8.filesusr.com/ugd/7dd30d_3d759c1c46854e37b92471c9d9584c82.pdf?index=true
    • https://3d5b2cfc-74f5-4c02-8466-0d369b02955c.filesusr.com/ugd/69b86f_b0376c59233c4c6696656f15d411347e.pdf?index=true
    • https://a79fbd7c-12a6-44fe-9d3c-43dc2b0795a8.filesusr.com/ugd/f95141_04941cf2d0784927bcdeb094772817ef.pdf?index=true
    • http://mevomum.epizy.com/kendo_angular_grid_header_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a7c6.bin
fe9b01b8698ccc0ce32afa1220c3149c02bf7c079624e520329cd5d489cd5f61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A7C6 3064 bytes
font_01_sfnt_off0001b2d6.bin
4b2da8883634f3c6872b5743bf5742c72d9073186d5f800e0b0e6c6925644270		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B2D6 5544 bytes
font_02_sfnt_off0001c53a.bin
a8ec3ec5ba887962071d13052861a83dfe95515ad22666291a3503020d3b19cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C53A 28392 bytes
font_03_sfnt_off00020506.bin
5aa9b35c95b7245706d43be624b01b1bc466da48c289ed0eec2d48a208b919ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20506 17284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.