Malicious PDF — malware analysis report

Static analysis result for SHA-256 7046f9683ddd8233…

MALICIOUS

PDF

82.4 KB Created: 2021-04-04 17:36:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 7d3de98c2a806abca0947737a8615603 SHA-1: 7e46b5ab12bae36ef1f203b64e9c8f2aa7dbcbcf SHA-256: 7046f9683ddd8233c6aa27d21d85e17b968cb5a336a16566ef0d38a5b097f0fa
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'vilenefex.ru', which is likely part of a phishing or malware distribution scheme. The document body, though malformed, suggests a lure for a 'calligraphy pdf free download', indicating a social engineering tactic to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=calligraphy+pdf+free+download PDF link annotation
    • http://telemprom.xyz/zuzafaxadawjmmpl.pdfIn PDF document text
    • http://tihefers.online/17922941301b85w8.pdfIn PDF document text
    • http://sysfix.ru/gugofodizajumurugudobkccs9.pdfIn PDF document text
    • http://lnstagramservicecopyrights.com/eduardo_galeano_biografiaa5vfi.pdfIn PDF document text
    • http://xefibusutama.22web.org/49995064792.pdfIn PDF document text
    • http://runolive.com/87762686861ro5f1.pdfIn PDF document text
    • http://salearea.pro/bluebeam_training_videosuxgkb.pdfIn PDF document text
    • http://brumbum2.xyz/343809075696f4qc.pdfIn PDF document text
    • http://vurenosul.22web.org/94082400118.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/ff61b6cc-3f27-48b8-a826-97d8dfedd311/88151796579.pdfIn PDF document text
    • https://s3.amazonaws.com/dugibabafod/turning_shapes_worksheet_ks1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75925550-7d90-4a61-8645-dcea66bab4c6/topixo.pdfIn PDF document text
    • https://s3.amazonaws.com/xukirizugukugi/61746943306.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37a0b09e-060b-4665-bb1c-6654d0ac3a73/char-broil_the_big_easy_tru-infrared_smoker_roaster__grill_lowes.pdfIn PDF document text
    • https://s3.amazonaws.com/dumupa/16946005148.pdfIn PDF document text
    • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_9d01d3d455f34bbabf5ef8af88c53078.pdf?index=trueIn PDF document text
    • http://guwavamo.rf.gd/90264733955.pdfIn PDF document text
    • https://s3.amazonaws.com/minabiwa/fowonomakixadijobexab.pdfIn PDF document text
    • https://8533cbf3-c0d6-400c-bdf8-8ca38cf0242b.filesusr.com/ugd/135178_6a8c98ca640a43279368b838a06f9597.pdf?index=trueIn PDF document text
    • https://c1d61d78-9bae-425c-b347-ee91470fe4f1.filesusr.com/ugd/60933b_5485262af9244e27a8ef6b8ff56661ce.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tufujifinobiro/merchant_navy_jobs_after_b.tech_mechanical.pdfIn PDF document text
    • http://nojisibi.rf.gd/kenugozamupigapalan.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4D5 5048 bytes
SHA-256: 79c9b35ce3da0b4a2494b738a83d2bc38afa26950b7b8f2b4d6b5fa7acf5c28d
font_01_sfnt_off0001060b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1060B 12004 bytes
SHA-256: 2b23c094e0aa03b7fdc1500ae1a24e5a3c356fd5dd3d1262c0f3e48d420c93a0
font_02_sfnt_off00012e45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E45 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.