Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d642fb6dac49703…

MALICIOUS

PDF

80.0 KB Created: 2021-05-24 13:54:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 4d53d477da88c395d07e602ee5910c35 SHA-1: 46459cd1565f8a4806c2bd873d7729b5730a49dc SHA-256: 5d642fb6dac49703109e8f71c2700b5fa1cc3094d8ed3628a7a2b7ddf16b666e
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a heuristic indicating a remote support tool lure, suggesting a social engineering pretext. It also embeds a URL that appears to be a lure for a video, which is likely a phishing attempt. The ML classifier strongly flags this PDF as malicious, and ClamAV confirms detection as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=video+chucky+2+full+movie+in+hindi PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4408583/normal_6017bf7cd2b21.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413361/normal_606a538c3594e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418166/normal_5fd7783854907.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8913f01-a956-4825-a288-15f7f5220f83/30873067080.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a93f536-f45a-48f3-9aec-3b1526e0937d/59039342143.pdfIn PDF document text
    • https://s3.amazonaws.com/lakadutof/fawoworabivewenaxejotufaw.pdfIn PDF document text
    • https://s3.amazonaws.com/forupokisip/how_to_change_batteries_in_hunter_douglas_shades.pdfIn PDF document text
    • https://s3.amazonaws.com/warapagefasovi/79267826013.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d96094b-af11-4d99-881e-c035c5967216/31088626706.pdfIn PDF document text
    • https://s3.amazonaws.com/sefipa/alien_lanes_guided_by_voices_full_album.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f52814ae-3209-486e-8d67-bdffcb744c2e/the_count_of_monte_cristo_malayalam_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7be3b7f9-4141-4f6f-b8a6-b0ebd0f40756/togifimera.pdfIn PDF document text
    • https://s3.amazonaws.com/fisulefajow/bubbleupnp_android_cracked.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/858c2274-0ab1-4cd3-afb9-93e1f82b0ff4/unblocked_cool_math_games_raze_3.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/dr_seuss_sleep_book_characters.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca7a1788-0e07-465d-90d2-fae2469bc4aa/46414576500.pdfIn PDF document text
    • https://s3.amazonaws.com/zatasipezeg/which_rice_cooker_is_best_in_australia.pdfIn PDF document text
    • https://s3.amazonaws.com/kelageketisefuv/93280536362.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72c5943b-4bad-45cf-b2d6-1906eab56c3f/what_happens_to_jacob_at_the_end_of_breaking_dawn.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ad19667-6668-402e-9a4f-cfaf9934ae5f/app_keeps_stopping_android_studio.pdfIn PDF document text
    • https://s3.amazonaws.com/vovuzize/vivujoxazawisa.pdfIn PDF document text
    • https://s3.amazonaws.com/rikolesafuwofar/swg_corellian_corvette_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/nabifovu/vopefidoweguvu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA9E 5100 bytes
SHA-256: 2f9152d57867e69426741b697dcc7dd86e33550f7686cb9c77076c81b3072b95
font_01_sfnt_off00010bed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BED 10756 bytes
SHA-256: b9f9d514f04b521669b0cda5972716f857972112d3767515a629f6f08d8e5558

Open this report in the interactive analyzer, or submit your own file for analysis.