Malicious PDF — malware analysis report

Static analysis result for SHA-256 64ee06a5fd164aeb…

MALICIOUS

PDF

90.3 KB Created: 2021-05-01 03:17:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a083710cc2671b4c8440a7c203d17c28 SHA-1: 2de9f7d501555ea6bec229c3c4feb44277e7316c SHA-256: 64ee06a5fd164aeb7d4941c45a6c7dc7a356b25856c9733f50e9ebd48b20903c
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host or deliver a secondary payload. The document's content suggests a lure related to an IQ test, further supported by a heuristic indicating a visual download button.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=printable+iq+test+questions+and+answers
    • http://losiruwu.66ghz.com/3120167790.pdf
    • http://amsidgi.xyz/best_video_games_to_play_at_school4cezi.pdf
    • http://mexuloxuxinona.iblogger.org/40192265281.pdf
    • http://vimatineluxux.22web.org/tozixuze.pdf
    • http://ostanni.fun/zusardpfy1.pdf
    • http://lishop.site/lezapixusiso722j7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d4b912d7-d989-42a9-bb8b-cbc66b93d598/2005_chevy_malibu_maxx_starter_problems.pdf
    • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_361d357606c84af9bf930e0e4e91c06e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/44478fb2-33e6-49c4-a7d4-82c28d9c6d6f/rakatu.pdf
    • https://d572dbd6-ec42-402e-884a-3db6daac2318.filesusr.com/ugd/6a558d_4503a33469a64ef7832e49b0eb2bbbaa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/af240db4-07a2-41ce-b8b3-10b8abefb867/doduxu.pdf
    • https://dc5983eb-04eb-4341-be6e-5f763cf8c8d0.filesusr.com/ugd/979c04_f2a2467336294e07be210035106308a1.pdf?index=true
    • http://runatabipodoxup.rf.gd/rubutezexinazizepun.pdf
    • https://s3.amazonaws.com/regovadeje/37429167391.pdf
    • https://s3.amazonaws.com/febopa/contract_acceptance_email_template.pdf
    • https://s3.amazonaws.com/lusabifef/70726961275.pdf
    • https://s3.amazonaws.com/rekawexuretowo/american_red_cross_blood_drive_requirements.pdf
    • http://ralupuwegilad.rf.gd/dynamics_365_licensing_guide_on_premise.pdf
    • http://vodesoxiside.rf.gd/a_text_book_of_clinical_pharmacy_practice.pdf
    • https://8533cbf3-c0d6-400c-bdf8-8ca38cf0242b.filesusr.com/ugd/135178_9d2d526f2cc7452999818bbf06abe1aa.pdf?index=true
    • http://najizomixa.rf.gd/kindle_model_d01100_update.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012305.bin
bbfb871a4d963788d6948a642db01a64929e3efa24771be6899eec6d8b2388fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12305 5180 bytes
font_01_sfnt_off000134b3.bin
bb4523b8ec6965d14e0535f538abad10141f3bcdc3708cdf883929991c397453		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134B3 11488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.