Malicious PDF — malware analysis report

Static analysis result for SHA-256 8552615f2233a8a5…

MALICIOUS

PDF

78.2 KB Created: 2021-03-11 14:42:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1670d9474e64327465b1b2f0a3796c77 SHA-1: b85ae7e2863fad86b4338f7ac664db24ef4145d6 SHA-256: 8552615f2233a8a5f6d4f714b39cc213c921ba8531c007f74b69c0ec30042427
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged as malicious by ML classifiers and ClamAV. It contains an embedded URL that appears to be part of a phishing lure, and the document body suggests a callback phishing or tech-support scam pretext. While no scripts were explicitly extracted, the PDF format can embed JavaScript, which is often used to facilitate such attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=free+credit+report+dispute+forms
    • https://cdn.sqhk.co/zukasedu/eqrdMTI/five_nights_at_freddy_s_download_free_laptop.pdf
    • http://baykamif.space/sipalurugemebilelpobtz.pdf
    • http://lenugaguv.medianewsonline.com/20637238109.pdf
    • https://cdn.sqhk.co/kisibijobu/bhhpgiG/90659470003.pdf
    • http://ideaita.fun/alt_j_relaxer_zip9v57d.pdf
    • http://dawezedelofeda.scienceontheweb.net/12700493924.pdf
    • http://2022god.com/john_michael_talbot_songs_be_not_afraid8cks3.pdf
    • https://cdn.sqhk.co/xuwadezab/bijcSRy/stewart_furniture_hubbard_ohio.pdf
    • https://cdn.sqhk.co/piredonina/bAKhhhc/jurimepitilulavazew.pdf
    • http://vorgazme.com/what_do_you_mean_by_sexually_fluid0dsxq.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vuzufexarevima/ribenagasebamu.pdf
    • https://s3.amazonaws.com/fokapikow/nomawotaxutik.pdf
    • https://s3.amazonaws.com/satulibaren/cdsco_guidelines_for_bioavailability_and_bioequivalence_studies.pdf
    • https://s3.amazonaws.com/mupukesunobaga/68162140508.pdf
    • https://s3.amazonaws.com/wetowuzuxit/acunetix_web_vulnerability_scanner_9._5_crack.pdf
    • https://uploads.strikinglycdn.com/files/61e30e60-034f-4a6a-8872-d6f8e7ade231/photoshop_mac_shortcut_change_brush_size.pdf
    • https://s3.amazonaws.com/dalava/sewatukefa.pdf
    • https://s3.amazonaws.com/zozofufulolig/approach_to_fever_with_rash.pdf
    • https://s3.amazonaws.com/tetenifeme/gaddafi_stadium_lahore_pitch_report_today_match.pdf
    • https://uploads.strikinglycdn.com/files/8efdf99a-6a08-4584-b80b-7b9634dae501/chuunibyou_demo_koi_ga_shitai_light_novel_volume_1.pdf
    • https://s3.amazonaws.com/jazamerijekufol/67959649945.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6e2.bin
362760974543422c6bd553bd3b33917e3ae42b69869da0bd423d5da2f34486a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6E2 5012 bytes
font_01_sfnt_off000107e1.bin
f5d2ff348a7687798f7c6ebad2da303bda30ac1b5874f5dfeefc047136a4bfa0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107E1 10444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.