Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f36b8346ae9e445…

MALICIOUS

PDF

78.8 KB Created: 2021-05-20 13:51:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 035e9b7483153116ab257b667e538c17 SHA-1: df04f67f7242c816860c3a173675c6123f13acdd SHA-256: 5f36b8346ae9e445a75a49c957d89cbf078bef77f9e2de69132b3f23b3368c70
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely used to redirect users to a malicious site or deliver a payload. No scripts were extracted, but the presence of the external URI and the ML/AV detections strongly suggest a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wb?keyword=drinkwell%20pet%20fountain%20cleaning PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366957/normal_60129545886fc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417023/normal_601b91bc7d431.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/xonobijikivo/77840660277.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66e8a28b-5b23-4ddf-9667-760bb414df4b/fleck_5600_instruction_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e0e8ed7-9917-4aca-be22-fc497fa388a3/82573495705.pdfIn PDF document text
    • https://s3.amazonaws.com/zukogi/puzakakuje.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/2453100210.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14768ed4-6fe0-4920-9a34-478c57a1d1a8/what_is_the_age_limit_for_a_car_seat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/570f3eaf-87c6-44f4-a62b-e3875f3f76c1/the_apocryphal_gospels_a_very_short_introduction.pdfIn PDF document text
    • https://s3.amazonaws.com/fajonubinomeder/how_to_use_modal_verb_should.pdfIn PDF document text
    • https://s3.amazonaws.com/dinilederu/56554407058.pdfIn PDF document text
    • https://s3.amazonaws.com/kijelopazekune/kegaxigafedewe.pdfIn PDF document text
    • https://s3.amazonaws.com/mijumomub/explain_vygotskys_theory_on_the_zone_of_proximal_development.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17e5a393-f2e2-47f6-afdd-3f1e1904b5e8/love_simon_book_sparknotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53d0d932-3df6-41ff-93b4-a9670e0b112c/chicco_nextfit_zip_air_manual_espaol.pdfIn PDF document text
    • https://s3.amazonaws.com/mukut/ase_guidelines_valvular_regurgitation.pdfIn PDF document text
    • https://s3.amazonaws.com/fizaxo/wokejakutumizixupamuzel.pdfIn PDF document text
    • https://s3.amazonaws.com/wusigipufuvowix/28311554676.pdfIn PDF document text
    • https://s3.amazonaws.com/xomudufe/backup_exec_20._4_administrator_s_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9560a58-22fa-492e-b364-aeb28fbb487e/nicole_brown_simpson_the_private_diary_of_a_life_interrupted_audiobook.pdfIn PDF document text
    • https://s3.amazonaws.com/tanapilamaxi/goroga.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e95f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE95F 5044 bytes
SHA-256: 72af36c6ed28d506f883862e12ad54c75078d2a5111f30474d5712ecb810f167
font_01_sfnt_off0000faab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAAB 10864 bytes
SHA-256: c972da07910845a9b15425d928cfecd3c702b7575d7499dd5bff7316d7956b5f
font_02_sfnt_off00011f93.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F93 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.