Malicious PDF — malware analysis report

Static analysis result for SHA-256 64fbe095e30426f5…

MALICIOUS

PDF

96.0 KB Created: 2021-04-30 08:52:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 08cb52942832f4ec9e0c8b68b7fd187f SHA-1: 68ba7eb077dfab747bfc3d3c14d24542dea3d25d SHA-256: 64fbe095e30426f55e3d472e0f0bd38aac1e533c5b9eeb0bfd4c5c57a6ca0d74
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, exhibiting characteristics of an advance-fee scam. It contains an external URI pointing to a suspicious domain, likely intended to lead the user to a phishing or malware download page. The document's structure and content strongly suggest a phishing attempt designed to trick users into believing they have won a prize or are due a payment, requiring them to click the provided link to claim it.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=cisco+learning+institute+ccna+security+pdf
    • https://cdn.sqhk.co/dolitife/jHlojc5/85108531748.pdf
    • https://cdn.sqhk.co/koletexun/qLjjt4T/29626968912.pdf
    • https://static.s123-cdn-static.com/uploads/4383924/normal_5ff6bf4697263.pdf
    • http://ninujovapazolo.iblogger.org/maplestory_leveling_guide_black_mage.pdf
    • https://cdn.sqhk.co/xifobariw/bojgXia/cars_movie_toys.pdf
    • https://cdn-cms.f-static.net/uploads/4459324/normal_60224031caedb.pdf
    • https://static.s123-cdn-static.com/uploads/4471688/normal_5fcbda10bc3ba.pdf
    • https://cdn-cms.f-static.net/uploads/4454682/normal_606b7680206da.pdf
    • https://cdn.sqhk.co/wifinalimow/8hfn8QC/fafelojam.pdf
    • https://cdn-cms.f-static.net/uploads/4389370/normal_60405cfe6e17b.pdf
    • https://cdn.sqhk.co/zoxinugokas/gdierqr/54445594512.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zikefibuji.rf.gd/bodyguard_movie_song_i_love_you.pdf
    • https://s3.amazonaws.com/xupizewuxere/xabigelisifimuxoraja.pdf
    • https://s3.amazonaws.com/mesixadelomomo/blade_runner_2048_parents_guide.pdf
    • http://ravitujupap.epizy.com/coenzyme_structure_and_function.pdf
    • https://s3.amazonaws.com/fasomusogapovi/wirutujomekutulimodevor.pdf
    • http://dojidusajotat.epizy.com/84395227108.pdf
    • https://s3.amazonaws.com/diwitapezu/guwozozobituxubi.pdf
    • https://s3.amazonaws.com/besafefaf/56180692247.pdf
    • https://s3.amazonaws.com/zuwosil/racing_games_for_android.pdf
    • https://s3.amazonaws.com/nuvukivaxiren/wabajo.pdf
    • https://s3.amazonaws.com/faduxodiwo/compound_interest_questions_for_competitive_exams.pdf
    • https://s3.amazonaws.com/mojivikapeti/lammps_boron_nitride_nanosheet.pdf
    • http://mikozigejeti.rf.gd/man_booker_prize_2020_winner.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013a2e.bin
59458faecd68d98a25d26e087e7cab43a097bd75ccb19da51f76e1668f837692		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A2E 5328 bytes
font_01_sfnt_off00014c68.bin
07fd5beef3bdf173cb471bc7d5fdac4b3aa6525eec1c52d30a50c9f816398890		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14C68 11100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.