Malicious PDF — malware analysis report

Static analysis result for SHA-256 628133d95af88d80…

MALICIOUS

PDF

76.7 KB Created: 2021-03-28 13:44:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78f081e2a9cf1b2df900bfb59e56badb SHA-1: 7868688f3db48487cee53d3eff886f1e756dcd92 SHA-256: 628133d95af88d807e5cd0eca3d688eb9aaa0104e2dcdc7ba5e4c164fa166914
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an external URI pointing to a URL that mimics a search result for a book download, suggesting a phishing or social engineering lure. No scripts were extracted, but the presence of external URLs and the malware detection indicate a malicious intent to trick the user into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=biological+anthropology+book+pdf+download
    • http://nepojar.22web.org/x_ray_body_scanner_free.pdf
    • https://cdn.sqhk.co/nunewole/kgc9Gji/rolajejorimugobediw.pdf
    • https://cdn.sqhk.co/luwesefizi/ggNz1he/94080250826.pdf
    • https://wojizenufojanog.weebly.com/uploads/1/3/4/7/134724603/1c7c948da251.pdf
    • https://cdn.sqhk.co/sezibagigi/r3P3hd4/loan_amortization_table_excel.pdf
    • https://cdn.sqhk.co/vobevufubito/KVjb5OK/sad_melody_piano_songs_from_movies.pdf
    • https://kunoloxudiruk.weebly.com/uploads/1/3/4/7/134767428/7076683.pdf
    • https://cdn.sqhk.co/rizonozugaj/bgdpi5O/nagixixafoku.pdf
    • https://subutadenurafo.weebly.com/uploads/1/3/4/5/134581349/poxisipabobugasetuke.pdf
    • https://xawupaxov.weebly.com/uploads/1/3/4/6/134699297/jubikebar.pdf
    • https://dunijolojuk.weebly.com/uploads/1/3/1/4/131437931/4580882.pdf
    • http://xazerakovewule.22web.org/how_to_reset_lg_washing_machine_pe_error.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bulujulu.rf.gd/14417905854.pdf
    • http://rebivik.epizy.com/fojejegekijikomodego.pdf
    • http://sitovimewimes.rf.gd/fomugidejowijavidek.pdf
    • http://vovajixavago.epizy.com/kidamezajasubebadaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec7b.bin
72a892be2e5be7454f146264205697c42bd443712f44723e478f5036b810c6fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC7B 5684 bytes
font_01_sfnt_off0000ffed.bin
30875809963770f15476c445cbb7e9438df7cf547a45db1fbccc0d3741a186b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFED 11492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.