Malicious PDF — malware analysis report

Static analysis result for SHA-256 618609f63c0f03d3…

MALICIOUS

PDF

200.4 KB Created: 2021-03-06 23:29:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: ebcd1dd912f65a34d67b19ab3557a6de SHA-1: f513632df5be7b25c5994c1734b999cd4b3c69a7 SHA-256: 618609f63c0f03d3ba37c0424c3bb58cdf753e96d6c53cbd4caad144365f5ada
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The 'SE_CALLBACK_LURE' heuristic indicates the document is designed to trick users into calling a phone number, consistent with callback phishing or tech-support scams. The embedded URL points to a domain that appears to be part of the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9935

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=typewriter+service+near+me PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4368250/normal_5ffea435000dd.pdfIn PDF document text
    • https://pudogujapoveg.weebly.com/uploads/1/3/6/0/136090910/pujozafeserozol_rijukagoxem_zolod_fizetodezebog.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486197/normal_603b48b470015.pdfIn PDF document text
    • http://dumubemajizukov.medianewsonline.com/2nd_grade_book_club_worksheets.pdfIn PDF document text
    • http://rasezatoxefu.mygamesonline.org/bodazuwonubewoxipus.pdfIn PDF document text
    • https://duresanu.weebly.com/uploads/1/3/5/3/135334900/4373032.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373769/normal_5fd91b0bd7837.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410448/normal_5fe60da7ee854.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372985/normal_602971d773182.pdfIn PDF document text
    • http://dupamineni.medianewsonline.com/how_to_process_unresolved_trauma.pdfIn PDF document text
    • https://kizekusoviwo.weebly.com/uploads/1/3/1/4/131453028/dopanegulupebatet.pdfIn PDF document text
    • https://wisiwojapano.weebly.com/uploads/1/3/4/8/134896472/593ea9c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380700/normal_60301beeb794c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376856/normal_603782c02e785.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447880/normal_601d21dc769dd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rodexiguv.onlinewebshop.net/3968784372.pdfIn PDF document text
    • https://4b3b4da4-1145-40fd-8a04-0ac29766dab0.filesusr.com/ugd/6c6203_3474c95164e1448db8b85480239b9882.pdf?index=trueIn PDF document text
    • https://923a8ca3-316b-4844-b38f-9bc955ad4852.filesusr.com/ugd/312e0e_b541e0dc3dd84cc6bd4f4d6d1cc67080.pdf?index=trueIn PDF document text
    • https://814cba0f-f649-4223-bfe6-7884e6e02b9d.filesusr.com/ugd/c1108c_ac4ab0ea095a4b28b547c21685a7962f.pdf?index=trueIn PDF document text
    • https://ef9d90ca-5811-4a1c-810e-75bcfae60121.filesusr.com/ugd/a33af7_896ddfb038964f83a37ea5e5da92561a.pdf?index=trueIn PDF document text
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_4caf1975aee2413fbc3f6239f4697254.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002d487.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D487 5248 bytes
SHA-256: a03a3bfaf2298f12899317606cc097feacbd4874156e330faae02dcd586ccf1c
font_01_sfnt_off0002e66c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E66C 14056 bytes
SHA-256: 27c8ca80dcd31c863ea1b2f4029cc140f8ee6b113703abeb57074306fd080e3a

Open this report in the interactive analyzer, or submit your own file for analysis.