Malicious PDF — malware analysis report

Static analysis result for SHA-256 641fe5276486dcfc…

MALICIOUS

PDF

74.6 KB Created: 2021-03-20 10:50:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6af94b67083b9caa2eaad507474f237d SHA-1: 1a22129b91b1cac707bfe5d04d3beab371ef79a2 SHA-256: 641fe5276486dcfcfafad44a17d7e6e53a43c0b526b73cda8c39718dfc3d5563
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and heuristic firings indicating it is a phishing lure, specifically disguised as a manual for a Honeywell alarm system. The primary malicious URL identified is https://mezovovuduw.ru/wix?keyword=honeywell+alarm+system+manual+k4576v2+m7458, which likely leads to the download of a secondary payload. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=honeywell+alarm+system+manual+k4576v2+m7458
    • http://vifezitenof.getenjoyment.net/extraneous_variables_in_research.pdf
    • https://poxopamit.weebly.com/uploads/1/3/4/7/134751622/307948fcbde0f4.pdf
    • http://hookup157.fun/haynes_manual_toyota_aygoj3bi9.pdf
    • https://xufudigu.weebly.com/uploads/1/3/4/5/134515134/2d33e8a45.pdf
    • https://kilixezexixoz.weebly.com/uploads/1/3/1/1/131163494/wejonerijaw_jebam_wizigeromujonil.pdf
    • http://xilenemivagola.mywebcommunity.org/deutsch_synonyme_wrterbuch.pdf
    • https://lopowizuxo.weebly.com/uploads/1/3/4/4/134438001/jijogipuxuvalajakige.pdf
    • http://makeyourself.xyz/oxford_dictionary_english_tamil_free_download3dk4o.pdf
    • https://jodajapiguzok.weebly.com/uploads/1/3/2/7/132710756/846b5d2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mafolizol.rf.gd/angry_birds_2_apk_2019.pdf
    • https://5a20c861-23fd-468b-888e-078c5342874f.filesusr.com/ugd/924841_f4598b4a14a542159f20f120e661b1aa.pdf?index=true
    • https://73f4d879-981c-49fe-abc7-520f36a14a84.filesusr.com/ugd/b77b08_0d3772837964484b915bfc4938a5a470.pdf?index=true
    • http://dipejigiz.epizy.com/salud_y_bienestar_animal.pdf
    • http://lunowakaneruf.rf.gd/29556119474.pdf
    • http://ziwemasux.myartsonline.com/metefakifozolobifopokuw.pdf
    • https://s3.amazonaws.com/rafiralexezol/branches_of_biology_questions_and_answers.pdf
    • https://s3.amazonaws.com/jubiferekaka/swot_analysis_template_ms_word.pdf
    • http://nexebudavosev.epizy.com/how_much_time_does_it_take_to_learn_r_language.pdf
    • http://duwawadava.rf.gd/how_to_screenshot_in_pc_windows_7_shortcut_key.pdf
    • https://s3.amazonaws.com/zaxefemebidaz/el_caballero_dela_armadura_oxidada_capitulo_1_el_dilema_del_caballero_resumen.pdf
    • https://s3.amazonaws.com/resixexi/76095463267.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e458.bin
2d34e2937101380e412ef70bdd9cc057c417eb280633fb7cea96c5ab86d73bb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE458 5880 bytes
font_01_sfnt_off0000f873.bin
bf678165be894dddba245bb8309c6882f71081ff5418a376ae9bcb6666a05957		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF873 10800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.