Malicious PDF — malware analysis report

Static analysis result for SHA-256 75be13e34da6d437…

MALICIOUS

PDF

238.7 KB Created: 2021-04-19 19:31:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 2dfc033e1a50528c329aa506fd9a698d SHA-1: 9c0ae555560cb78890dfc154c1dadb3215de1be3 SHA-256: 75be13e34da6d4375117f3d64b7d8e76368d7dd4bb74fff2d37a3f66e9431428
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a callback-phone (TOAD) lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9817

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=hp+elitedesk+800+g1+dm+graphics+drivers PDF link annotation
    • http://podarokinsta.online/73827635382ual82.pdfIn PDF document text
    • http://ig-copyrightviolation.com/mount_and_blade_warband_viking_conquest_serial_key_free6jtw7.pdfIn PDF document text
    • https://cdn.sqhk.co/mumeriretepi/XjhTjco/beluramalapagewad.pdfIn PDF document text
    • http://nikaold.site/vumixevqime.pdfIn PDF document text
    • http://fezufizibum.mypressonline.com/anxious_for_nothing_max_lucado.pdfIn PDF document text
    • https://cdn.sqhk.co/rodisukipi/1jfhgz0/merge_snake_apk_download.pdfIn PDF document text
    • https://cdn.sqhk.co/webuzifinuno/I4ibjjV/5037808797.pdfIn PDF document text
    • http://zexawabezazojot.sportsontheweb.net/zurepivanoze.pdfIn PDF document text
    • https://cdn.sqhk.co/mikedeto/jggxdid/xijuluge.pdfIn PDF document text
    • https://cdn.sqhk.co/julukimesof/gj0jd4A/52103576718.pdfIn PDF document text
    • http://vesajob.getenjoyment.net/sociology_of_health_and_illness_lecture_notes.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/gixawetopoli/rigosiluxogesemadabew.pdfIn PDF document text
    • http://nadisawom.rf.gd/weduxopukurigel.pdfIn PDF document text
    • https://7f3356c1-ec1f-498a-9d41-5b36c14d87b7.filesusr.com/ugd/98d33d_b754905a8fa248928d52f263bd106072.pdf?index=trueIn PDF document text
    • http://tivapatovike.epizy.com/xagepovedo.pdfIn PDF document text
    • http://salegemivogo.epizy.com/bonafide_certificate_format_student.pdfIn PDF document text
    • http://foduxidepozipiw.myartsonline.com/skripsi_penyakit_jantung_koroner.pdfIn PDF document text
    • https://5be7aec3-7d66-433b-ae1d-2bfb807ddf2a.filesusr.com/ugd/24deb6_7ee22323dbe446fd8be693a98602f6a9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dexodekelaseki/arizona_cardinals_new_uniforms_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/jidosatikim/27144376854.pdfIn PDF document text
    • https://s3.amazonaws.com/rebomedug/74992714884.pdfIn PDF document text
    • http://duzoxugulof.rf.gd/revelian_cognitive_ability_test_practice.pdfIn PDF document text
    • http://zuzopejorexa.onlinewebshop.net/pdf_split_apk_download.pdfIn PDF document text
    • https://229c3593-bb94-4e5d-9b9f-ca3747df48ef.filesusr.com/ugd/145364_275d8c38ef1b40d6be369b034019f0f5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jalasilunaz/how_to_reheat_maggianos_pasta.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000363c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x363C1 5532 bytes
SHA-256: bd0606a0e81c58a6a0b6a5f268b951179f1cf0ed8853b2408f1e4d0d65270c2e
font_01_sfnt_off00037699.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37699 11560 bytes
SHA-256: 37c8043da109aff940de5048b0fcb72394a17038ffdbae28df770eb28b56c618
font_02_sfnt_off00039dc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39DC7 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.