Malicious PDF — malware analysis report

Static analysis result for SHA-256 72749ff605e46a43…

MALICIOUS

PDF

213.9 KB Created: 2021-04-04 03:50:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 152f4452c5cec0ce30db46a50f472c15 SHA-1: 4b3b77fab6b9f48331d1f7317eec2deba498eaf7 SHA-256: 72749ff605e46a4332f0b9b71cbaa250fc66e6b24d57510214482c032ce3dc9c
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically identified as a phishing trojan. The embedded URL suggests a lure for downloading further malicious content, disguised as revision notes. The presence of a 'download button' heuristic further supports the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=chemistry+form+3+revision+notes+pdf
    • https://static.s123-cdn-static.com/uploads/4456699/normal_5fef43ac62f1e.pdf
    • https://rosanibo.weebly.com/uploads/1/3/4/8/134873488/gelotuvonu_limelopi_ditidutorimapit.pdf
    • https://dolevepi.weebly.com/uploads/1/3/4/5/134587457/zivibaded.pdf
    • https://cdn-cms.f-static.net/uploads/4424696/normal_6052daabd4a4c.pdf
    • https://cdn-cms.f-static.net/uploads/4366308/normal_605c740d92f9d.pdf
    • https://cdn-cms.f-static.net/uploads/4410222/normal_604a347679fd9.pdf
    • https://vufobuvi.weebly.com/uploads/1/3/1/1/131163959/9072f8b109.pdf
    • https://wivevesatowot.weebly.com/uploads/1/3/0/8/130813399/bomeluvapejupukap.pdf
    • https://xalakadumikimam.weebly.com/uploads/1/3/1/4/131437423/fekitosebo.pdf
    • https://static.s123-cdn-static.com/uploads/4485308/normal_5ff7d7bfb9882.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/73682cb1-daf4-419b-9074-b5df273cf408/58972592445.pdf
    • https://s3.amazonaws.com/punurum/42605712141.pdf
    • https://s3.amazonaws.com/zumomasugipeno/56600071690.pdf
    • https://s3.amazonaws.com/jovekus/dixedajaxatuvugolaxabifu.pdf
    • https://s3.amazonaws.com/zowejunef/xilekuligivijelor.pdf
    • https://s3.amazonaws.com/remavuj/chirutha_movie_all_songs_free.pdf
    • https://s3.amazonaws.com/paxunu/cifra_club_tuner.pdf
    • https://s3.amazonaws.com/boduxatavepe/39529617954.pdf
    • https://s3.amazonaws.com/numunenoji/charles_bukowski_go_all_the_way_book.pdf
    • https://uploads.strikinglycdn.com/files/1a5de465-2778-4f3d-81f2-a4e0012ede1e/google_maps_has_my_home_location_wrong.pdf
    • https://s3.amazonaws.com/rikolesafuwofar/true_metrix_blood_glucose_meter_user_manual.pdf
    • https://uploads.strikinglycdn.com/files/56260c4f-990a-4713-bf4b-5cb400d6901e/allmodern_open_box_price.pdf
    • https://01d7ec8a-e38e-4e33-8c76-1be31754498b.filesusr.com/ugd/24d943_a6d4f16f3e1648c6ba011a24495407b7.pdf?index=true
    • https://52c77544-2eb8-427c-ad0e-a8a7e2ea9366.filesusr.com/ugd/93288f_c7e9347b312244a0be8c3f41e73cf892.pdf?index=true
    • https://s3.amazonaws.com/wuniku/wafebasedeligitu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002f668.bin
6725485a5713fd3feae64418e8695a2cb105fba6b08dde5616a7b658c4548d98		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F668 5268 bytes
font_01_sfnt_off00030835.bin
a973ab922884d319ad3e30b300b454dcc4bdc7b10813137914c2c7ebc894f7c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30835 12284 bytes
font_02_sfnt_off0003324c.bin
225bf1b413d1e61042135633d7c0b683e22748fd2de1f3a1dbcbcccbbbb8d09c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3324C 16248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.