Malicious PDF — malware analysis report

Static analysis result for SHA-256 789fa210a6dbdfe8…

MALICIOUS

PDF

76.9 KB Created: 2021-03-09 18:15:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b608db02709265f0b5ef84dcf54a6354 SHA-1: 17c052e7da46d9afe3a43095b48e4d6d3463d936 SHA-256: 789fa210a6dbdfe8906d222f3887c1499f4c7bc22987dc788d9682d6c306bb0c
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to a suspicious domain, which is likely part of the malicious payload delivery. The presence of a 'download' button heuristic further supports the phishing lure attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=nhs+cambridgeshire+and+peterborough+ccg+annual+report
    • http://mixezitubut.mygamesonline.org/12792951756.pdf
    • https://polaposegit.weebly.com/uploads/1/3/4/5/134591324/6701907.pdf
    • https://sefariduzaki.weebly.com/uploads/1/3/4/6/134665623/6139599.pdf
    • http://zujadise.scienceontheweb.net/setepumusopedesiken.pdf
    • http://penageli.getenjoyment.net/denon_avr-2312ci_arc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://bf23b77b-49a9-4bef-a898-a03cfb94aefa.filesusr.com/ugd/134172_286ce6da6eb44a358f4b6f6de6dd309e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e7a7f85f-26d7-4623-afa7-e1c3f9e65c74/how_to_pronounce_evangelium_vitae.pdf
    • https://uploads.strikinglycdn.com/files/bff64e1d-66f7-41ef-8b55-b6b8c4aeee61/24182414777.pdf
    • http://dafiwogi.rf.gd/sipipalusawesewabi.pdf
    • https://s3.amazonaws.com/figugipopar/happy_birthday_animated_video_for_whatsapp.pdf
    • https://s3.amazonaws.com/vukumesoj/tafazusobedes.pdf
    • http://vekifaxofezawe.epizy.com/adobe_after_effects_text_animation_presets.pdf
    • https://uploads.strikinglycdn.com/files/e84b2561-2843-493d-8e9c-573334686dcf/xolujokagojezotofavisun.pdf
    • http://dunixojojulif.epizy.com/how_to_find_density_with_pressure_and_height.pdf
    • https://s3.amazonaws.com/polojuliragam/461463283.pdf
    • https://c6926203-1eb9-401e-9afa-11f61f201807.filesusr.com/ugd/685707_6679f3fbd21b431bb9819bf456ca595f.pdf?index=true
    • http://sekizipax.rf.gd/dasorewube.pdf
    • https://uploads.strikinglycdn.com/files/6dddb98e-7b33-4d19-b970-ce0735acab0e/sofuxelebojubat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e134.bin
e54767d96739e3dc3fd6513d636eb093d08907cd175692d63a7bcd479298d172		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE134 5480 bytes
font_01_sfnt_off0000f3a5.bin
89172a275d1ee25e0f0a599bbf8b48cda4381c9d11229827b8a61ec2e69a89aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3A5 10696 bytes
font_02_sfnt_off00011802.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11802 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.