Malicious PDF — malware analysis report

Static analysis result for SHA-256 8240d1514a7e48d6…

MALICIOUS

PDF

84.9 KB Created: 2021-03-20 00:59:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4c14279b7a04845d59d6fb7ec03841a SHA-1: b3a0a5cf3750170f8bfbd27d63093c0ed8ee256f SHA-256: 8240d1514a7e48d65a5a1c36832c53d7d41a6a18cdedfe9785b4439d1520f798
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains embedded URLs, one of which is flagged as malicious. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document's purpose is to trick the user into downloading and opening a password-protected archive, a common tactic for malware delivery. ClamAV also detected this file as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=radial+nerve+examination+pdf
    • https://cdn-cms.f-static.net/uploads/4480893/normal_601a824a607c2.pdf
    • http://bluhgang.best/doa_barbara_novela_completa_capitulo_422z8bz.pdf
    • https://lawukexudemodu.weebly.com/uploads/1/3/4/0/134041757/ziwag-mitosakafan-ligowabus.pdf
    • https://sutukedepebovi.weebly.com/uploads/1/3/4/7/134753024/pokavavavirasor-bidoruwixogul.pdf
    • https://static.s123-cdn-static.com/uploads/4367624/normal_600361446894a.pdf
    • http://hurricane1.space/integumentary_system_quiz_with_answersp92cq.pdf
    • https://cdn-cms.f-static.net/uploads/4449629/normal_600c8a165e6c1.pdf
    • http://bilabugova.iblogger.org/98019964206.pdf
    • http://habirovradik.ru/nalimatererepematajivom8k7e.pdf
    • https://nudezodubazez.weebly.com/uploads/1/3/1/1/131164524/noziveramozizisi.pdf
    • https://static.s123-cdn-static.com/uploads/4404308/normal_5fccb20c8731a.pdf
    • http://varuvoruva.iblogger.org/susifurubuxoja.pdf
    • https://wolazana.weebly.com/uploads/1/3/0/7/130775510/8569767.pdf
    • http://dk-inc.xyz/3757527462r0sd1.pdf
    • https://cdn-cms.f-static.net/uploads/4378167/normal_6011040fd1aaa.pdf
    • http://wevesapawuzu.22web.org/lunuxusodijadu.pdf
    • http://interior.estate/equivalent_fractions_worksheet_year_5_tesjmnvf.pdf
    • http://remebetegekit.iblogger.org/26264564343.pdf
    • https://romubavopu.weebly.com/uploads/1/3/4/8/134884942/firer.pdf
    • https://fivalukovegobag.weebly.com/uploads/1/3/4/6/134693255/2ff3a5add17.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://povutov.epizy.com/81849066563.pdf
    • http://kuporalegumema.epizy.com/superficial_thrombophlebitis_guidelines_australia.pdf
    • http://tukozadagafewan.rf.gd/agriculture_information_in_english_wikipedia.pdf
    • http://xakosafejel.epizy.com/movadif.pdf
    • http://wetafemef.epizy.com/assassin_leveling_guide_ragnarok_revo_classic.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f864.bin
380975cd0977082d69710a7a72dfe793615671d9d940a746ffe4e554f23a0115		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF864 5144 bytes
font_01_sfnt_off000109de.bin
7003a25aa28e545acde73e9a0635f23be64842b0e2a61bcf92cfaba1b7791fac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109DE 11204 bytes
font_02_sfnt_off00013014.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13014 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.