Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c6843494bf7a0b3…

MALICIOUS

PDF

91.8 KB Created: 2021-03-24 22:45:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: b15adc70aca30dc15414b05e4ae851ca SHA-1: 8040f764dc636b475655a66c8acea40a936718f5 SHA-256: 6c6843494bf7a0b35d677caf227cab073d3938b9aaae1bea000ddb21cc488f1a
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The sample was flagged by ClamAV as a phishing trojan and a machine learning classifier indicated a high probability of maliciousness. The heuristic 'SE_PAYMENT_REDIRECT_LURE' strongly suggests a business email compromise (BEC) or financial phishing attempt. The embedded URL 'https://nipisod.ru/wix?keyword=la+crosse+county+register+of+deeds' likely leads to a malicious site designed to harvest user credentials or financial details.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=la+crosse+county+register+of+deeds PDF link annotation
    • http://wisecredit.info/408285506onslu.pdfIn PDF document text
    • http://vulufinagi.mypressonline.com/goloduperaxofaledujovoneb.pdfIn PDF document text
    • http://geosen.net/go_math_reteach_book_grade_5_answer_key6y9bh.pdfIn PDF document text
    • http://vuvulusigi.scienceontheweb.net/pathoma_2019_reddit.pdfIn PDF document text
    • http://lebedugipul.mywebcommunity.org/motorola_mb810_sim_card_location.pdfIn PDF document text
    • http://3gusevshop.website/battle_creek_michigan_police_shootingz3z5z.pdfIn PDF document text
    • http://matrixbicycles.com/fodudul5g70.pdfIn PDF document text
    • http://terugate.mypressonline.com/mixekap.pdfIn PDF document text
    • http://gopagafab.medianewsonline.com/48928889830.pdfIn PDF document text
    • http://weareanonymous.org/veeram_songs_free_download_mp33ng1a.pdfIn PDF document text
    • http://ruwazumusef.scienceontheweb.net/the_synchronicity_key_review.pdfIn PDF document text
    • http://zokugorevat.mywebcommunity.org/larufirufelupib.pdfIn PDF document text
    • http://vigastlens.xyz/how_to_turn_off_hot_springs_portable_spame4g8.pdfIn PDF document text
    • http://figuxovutofid.mygamesonline.org/fundamentos_de_metodologa_de_la_investigacin_roberto_hernndez_sampieri.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/nefagolom/90940367654.pdfIn PDF document text
    • https://s3.amazonaws.com/xapidajovaji/85467583013.pdfIn PDF document text
    • http://netomadutimafe.onlinewebshop.net/short_fairy_tales_in_english.pdfIn PDF document text
    • https://s3.amazonaws.com/wofaxil/samsung_galaxy_tab_a_sm-t580_case.pdfIn PDF document text
    • https://s3.amazonaws.com/zuxime/73284283136.pdfIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/ponniyin_selvan_cast_role.pdfIn PDF document text
    • https://s3.amazonaws.com/ladojenefe/womupit.pdfIn PDF document text
    • https://s3.amazonaws.com/tixedujegibex/andis_dog_grooming_blade_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/pugomonapoxuxe/activex_plugin_for_internet_explorer_11.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fedb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEDB 5684 bytes
SHA-256: 06005db219ebc21a932ac848f8867d2382d381502ed8c20efbdd5b0625e62c64
font_01_sfnt_off000112bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112BB 5200 bytes
SHA-256: e7795d0c95047a8770c93b0f1968dd4f3e8c180f26e6125fa8686daf9392951b
font_02_sfnt_off0001247c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1247C 6640 bytes
SHA-256: 538512be6c526ea957b587fa229624d829dca4873b622d187784a60d2c877fcd
font_03_sfnt_off0001361a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1361A 14184 bytes
SHA-256: 9232f99f88fb1b5d4202e05ced005d777bf22cc03536fb33b53456d9ed755009

Open this report in the interactive analyzer, or submit your own file for analysis.