Malicious PDF — malware analysis report

Static analysis result for SHA-256 7258123cbe48dd8d…

MALICIOUS

PDF

84.3 KB Created: 2021-03-27 10:21:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a9e745d4d68fcb02822935da568eb754 SHA-1: bfc87c6d290f640277494ee15b15efb2daa3aa21 SHA-256: 7258123cbe48dd8d093c60d301f9dd174d8ca5d620277a76f6fbe9874ba15fa8
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The 'SE_CALLBACK_LURE' heuristic suggests the document is designed to trick users into calling a phone number, consistent with phishing or tech-support scams. An external URI was found pointing to a URL that appears to be part of this lure, likely leading to a phishing page or further malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=scissor+truss+height+calculator
    • https://cdn.sqhk.co/sunawopi/Fiefpjc/96186306539.pdf
    • http://itawomen.fun/66860977317rzytw.pdf
    • https://static.s123-cdn-static.com/uploads/4464862/normal_5fde9fcbdcee5.pdf
    • https://cdn-cms.f-static.net/uploads/4381101/normal_605a4524684d3.pdf
    • http://jirafka.space/dungeons_and_dragons_stranger_things_character_sheets3bvsv.pdf
    • https://cdn.sqhk.co/puxolika/lC5YgjD/survivor_adventure_survival_island_pro.pdf
    • http://smartycredit.info/streetcar_named_desire_bookk736t.pdf
    • http://busibear.com/tabela_de_conjugao_de_verbos_em_ingles9qqiz.pdf
    • https://cdn.sqhk.co/kivipemo/hhjdhid/43068504625.pdf
    • https://cdn.sqhk.co/mawebugo/AXjhXdN/concise_anglo_saxon_dictionary.pdf
    • http://4bochki.ru/braava_beeps_while_charging7ugtw.pdf
    • http://mexicotop3.xyz/it_essentials_chapter_8_quiz_answersryz8w.pdf
    • https://static.s123-cdn-static.com/uploads/4380213/normal_5fcdfc889bcf5.pdf
    • http://pedrons.space/202096548473f6bd.pdf
    • https://cdn-cms.f-static.net/uploads/4366647/normal_601604f9d26ae.pdf
    • http://copyright-helps-team.com/46658497622pwjkk.pdf
    • http://mainsale.pro/chuchel_2_apk361qc.pdf
    • https://static.s123-cdn-static.com/uploads/4414331/normal_5ff3ce57b9042.pdf
    • https://cdn.sqhk.co/kolazapikib/iggjjdw/tepefipulodikopaf.pdf
    • http://dkshlyap.ru/wenudevenetilipijebisopohedz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://95c758d6-fd33-43c6-b5d0-f1f55e07e946.filesusr.com/ugd/cb0188_3686d4f892434d0c894651ff22d9dc65.pdf?index=true
    • https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_dbb8c8c43eb84cc382f453a49a5d1bbb.pdf?index=true
    • https://94ac7338-8c66-48ed-b7e4-01cccba3eff0.filesusr.com/ugd/9b8421_e0cd681819794a439b6b861d93a33af6.pdf?index=true
    • https://18cb0a1d-3822-48a5-9ca0-56465202bc9b.filesusr.com/ugd/96564c_071cd07e0ff840f7afa35db4983bc8cb.pdf?index=true
    • https://f608bf75-187c-4b28-9621-af925c05c2b6.filesusr.com/ugd/05e3ad_af83e7d9ff204228a73a5cc4df09db9b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0001244e.bin
1b18ca111df9c46edc39ea64b3ffd9669646fb6fb480cfdb0586a88dd747639d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1244E 18604 bytes
font_00_sfnt_off0000e9d3.bin
74a5cd84ce01e42eaf3de1cee6119b5161a8c12583088b15f6dd5bbdc0b3369b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9D3 5164 bytes
font_01_sfnt_off0000fb5e.bin
d7db2fdefde6ef6cfa338cd2c141cccabe7656269581165eac2bf0a3eebfd2f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB5E 12228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.