Malicious PDF — malware analysis report

Static analysis result for SHA-256 7568d4249cea6820…

MALICIOUS

PDF

84.7 KB Created: 2021-02-16 00:02:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e68c4f0eb16d998631bf146c750522b SHA-1: 732ca6a4c89dee57c378196ec9f6ab26e2ec010a SHA-256: 7568d4249cea682098a5c8fc83d3cefea042bcb719953c33fcf7453f3359010d
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of an advance-fee scam. The document contains lures related to lotteries or parcels, combined with wording about large sums of money and delivery requirements. An external URI pointing to a URL with a 'keyword' parameter suggests a phishing or scam attempt to gather user information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=how+to+get+netspend+bank+statement
    • http://vovevowumusiki.iblogger.org/addictive_keys_mark_one_free.pdf
    • https://static.s123-cdn-static.com/uploads/4451561/normal_5fdf0078538af.pdf
    • https://cdn-cms.f-static.net/uploads/4403688/normal_5fe701e7d6696.pdf
    • https://cdn.sqhk.co/furafurume/hgZigia/pazalulaxatobanez.pdf
    • https://cdn.sqhk.co/woledibiroju/gjdheic/used_drum_set_for_sale_in_cebu.pdf
    • https://cdn-cms.f-static.net/uploads/4443354/normal_6010f82e80d61.pdf
    • https://static.s123-cdn-static.com/uploads/4450336/normal_5febfa1dca459.pdf
    • http://fimewot.xyz/the_legend_of_zelda_ocarina_of_time_3ds_rom_espaol_descargareb2id.pdf
    • http://design-kvartira.info/64317977096gex1e.pdf
    • https://cdn-cms.f-static.net/uploads/4412151/normal_60153d910b50f.pdf
    • https://cdn.sqhk.co/jefulajidi/KicigFl/siren_head_horror.pdf
    • https://static.s123-cdn-static.com/uploads/4403684/normal_5fdfce177c3b8.pdf
    • https://cdn.sqhk.co/posebozej/YjehaXF/mufugidor.pdf
    • http://vengriya.space/personal_expense_software_free2e2gi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://kafudunafow.epizy.com/bixupefusetuse.pdf
    • https://s3.amazonaws.com/xalasawu/berceuse_piano_sheet_music.pdf
    • http://numorajigot.epizy.com/42186145904.pdf
    • http://liwusetokabozil.epizy.com/zewuwuwofupevedozo.pdf
    • https://s3.amazonaws.com/purawuma/gabizusewod.pdf
    • http://botozagelexi.rf.gd/android_one_nokia_3._1_plus.pdf
    • https://s3.amazonaws.com/donarepemi/5145272532.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00011be2.bin
52550ffd9009a867761adcd8299c4feb7326f2ee91c89206e3c60f6422d3eeda		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11BE2 17676 bytes
font_00_sfnt_off0000e619.bin
e2863be200863ced7d81284a7867f73abebcb093d33a46866dbca7279028641b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE619 5148 bytes
font_01_sfnt_off0000f794.bin
04cb2ed7d069fe69afbad9c993e70a5160ab824163be9c1214ac372e497cb70f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF794 10644 bytes
font_03_sfnt_off00013628.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13628 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.