Malicious PDF — malware analysis report

Static analysis result for SHA-256 8451cf47ed25c2c8…

MALICIOUS

PDF

94.5 KB Created: 2021-06-02 20:36:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d8ef55dc48465ebfed4c149b396dcd88 SHA-1: 4f37edf7c379727cbe044a904744be77b4fba127 SHA-256: 8451cf47ed25c2c8f6c7e438766a7afdeb8612eef53cc5991964f68b2e1788e7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URL pointing to 'crewmak.ru', which is likely a phishing or malware distribution domain. The PDF structure and embedded content suggest it's intended to trick users into visiting this external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=cardcaptor+sakura+manga+order
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/adcd6a68-bb61-4a01-968a-f57e79ccb9d9/61342027824.pdf
    • https://uploads.strikinglycdn.com/files/e154f0c1-c0d8-4785-bc83-06933c8373da/medidas_para_la_prevencin_de_contagios_del_covid-19_en_el_trabajo.pdf
    • http://giwupiraride.pbworks.com/w/file/fetch/144445677/anti-tifico_o_de_salmonella_positivo_1_80.pdf
    • https://uploads.strikinglycdn.com/files/88436e06-509d-40df-9742-155e7be3fc31/goddess_kiss_ove_generation_guide.pdf
    • http://xesimisejek.pbworks.com/w/file/fetch/144501633/best_diy_security_camera_system_australia.pdf
    • http://zufogopojut.pbworks.com/f/93939849078.pdf
    • http://gorixose.pbworks.com/f/jegenanutarajiwosesol.pdf
    • https://uploads.strikinglycdn.com/files/322b2050-7265-4a22-a080-b8c02f8e98ee/subject_pronoun_worksheets_grade_1.pdf
    • https://uploads.strikinglycdn.com/files/d6fb861c-7ab3-43ba-b0f9-c0400355325b/77503331187.pdf
    • http://fuxedemama.pbworks.com/w/file/fetch/144516066/81825068273.pdf
    • https://uploads.strikinglycdn.com/files/f88bc8e0-89dd-4d35-845d-e6028db58dc3/82749626477.pdf
    • https://uploads.strikinglycdn.com/files/453dc2cf-bce4-4da5-a9fa-2cc8468de145/when_your_love_quotes.pdf
    • https://uploads.strikinglycdn.com/files/29cb585f-ed49-4197-aee2-8bce2a662732/94132184832.pdf
    • http://gemometis.pbworks.com/w/file/fetch/144520782/39080932173.pdf
    • https://uploads.strikinglycdn.com/files/95eaf681-3a24-4a91-9755-66cdaa0bf751/i_will_make_you_understand_meaning_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/7e3b0c64-bf26-4ce9-97ab-ab6a1f478f0a/what_type_of_oil_does_a_ariens_snowblower_take.pdf
    • http://mapaduzipi.pbworks.com/w/file/fetch/144507726/586283766.pdf
    • http://niwomif.pbworks.com/f/movezezabu.pdf
    • http://padimagofo.pbworks.com/w/file/fetch/144453303/yaad_piya_ki_aane_lagi_new_mp3_download_mr_jatt.pdf
    • http://zopujoxobug.pbworks.com/w/file/fetch/144412188/44123414292.pdf
    • https://uploads.strikinglycdn.com/files/4d0ab309-12e0-4f34-bb5e-f3ae98002937/88075870684.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000134ac.bin
9fa6c2400c1424d5f6e60169d766fd60dd83e5cd21e2af9825e7d1170e499f10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134AC 5332 bytes
font_01_sfnt_off000146b8.bin
d1b42578410087dd5b4eba171e57862a80d348d588ed4efdae324b3f0d6490eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x146B8 11312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.