Malicious PDF — malware analysis report

Static analysis result for SHA-256 78efc412a84605a9…

MALICIOUS

PDF

87.6 KB Created: 2021-06-14 12:02:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc075bb6cf9bf69c47e524b972f4aba4 SHA-1: 657e57f7456a77a8930db20723814671cae194b3 SHA-256: 78efc412a84605a93ab0edc5c26e42589fedf130eabe83a1f4878af09f0af42f
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically identified as a phishing trojan. The presence of an external URI pointing to 'krisoc.ru' suggests an attempt to redirect the user to a malicious site or download a payload. Although no scripts were explicitly extracted, the 'SE_DOWNLOAD_BUTTON' heuristic indicates a common social engineering tactic used in phishing to trick users into initiating a download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/pbw?utm_term=malayalam+novels+of+madhavikutty+pdf
    • https://cdn-cms.f-static.net/uploads/4385614/normal_5fe63c4e2cc03.pdf
    • https://cdn-cms.f-static.net/uploads/4476582/normal_60481a1bde3ce.pdf
    • https://cdn-cms.f-static.net/uploads/4407777/normal_6060a734813d1.pdf
    • https://cdn-cms.f-static.net/uploads/4412154/normal_605bc7c23aba8.pdf
    • https://cdn-cms.f-static.net/uploads/4414491/normal_5fe6a9893e7c6.pdf
    • https://cdn-cms.f-static.net/uploads/4458635/normal_60438b7f222b6.pdf
    • https://static.s123-cdn-static.com/uploads/4454162/normal_5fed16b399b9b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xesimisejek.pbworks.com/w/file/fetch/144558033/rokodufezikepijubozax.pdf
    • http://dokadeku.pbworks.com/f/rockstar_full_movie_download_movierulz.pdf
    • http://tisowowuduwe.pbworks.com/f/jotulowulelove.pdf
    • http://dobifapig.pbworks.com/f/xuwadebom.pdf
    • http://mapaduzipi.pbworks.com/f/58038798274.pdf
    • http://misabovu.pbworks.com/w/file/fetch/144919956/rimotiva.pdf
    • http://joraxakegeg.pbworks.com/f/kingdom_death_monster_rules_download.pdf
    • http://fisaramunuf.pbworks.com/w/file/fetch/144804642/figuras_sencillas_tangram_para_nios.pdf
    • http://kemulosomul.pbworks.com/f/58210808219.pdf
    • http://ravowibosu.pbworks.com/f/datuvovotuvojezezul.pdf
    • http://dokadeku.pbworks.com/f/class_7_maths_assignment_on_integers.pdf
    • http://wikoborumun.pbworks.com/f/59135752185.pdf
    • http://felinemumivu.pbworks.com/w/file/fetch/144526308/60586791179.pdf
    • http://xuwuziz.pbworks.com/w/file/fetch/144621126/jaya_piritha_sinhala_free_download.pdf
    • http://xutosop.pbworks.com/f/samsung_galaxy_s9_oem_unlock.pdf
    • http://lekadebixe.pbworks.com/f/56735513517.pdf
    • http://lalunanefiw.pbworks.com/w/file/fetch/145097841/auto_clicker_android_6.0_1_no_root.pdf
    • http://misabovu.pbworks.com/w/file/fetch/145206360/passive_voice_exercises_present.pdf
    • http://zuwofig.pbworks.com/w/file/fetch/144543243/wakuvemitowikajewodiguz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010211.bin
e0d9d1dcf97fcba50ad96a86d8a5e36807f0372b4a3dd2a8967e19abdcbc173e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10211 5416 bytes
font_01_sfnt_off00011476.bin
5ccac789668842ca60d1e671431330ece3ab155a526762ef1dbde5390837cd8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11476 11480 bytes
font_02_sfnt_off00013b8b.bin
5bfda07072dd2e1b0df7f1680a75ba616774ec51e1a09c257f000ba239241e1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B8B 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.