Malicious PDF — malware analysis report

Static analysis result for SHA-256 877f3dbe7409e626…

MALICIOUS

PDF

171.0 KB Created: 2021-03-12 15:30:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 700b3aced6c47ae0596b0fb9f235bda9 SHA-1: 101b5c1c4abe9546f70d530018d09f22fcd3be26 SHA-256: 877f3dbe7409e626ceb202bf3855b5fb4fbb0aa12b5a8d1bae5ff5cc6493a724
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. Heuristics indicate it uses an advance-fee scam lure, presenting the user with a fabricated prize or benefit. The document contains an embedded URI pointing to a suspicious domain, likely intended to lead the user to a phishing or malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=acs+mammogram+guidelines+2017
    • https://cdn.sqhk.co/jumupebuvi/gfhjrie/cinemark_theatres_stock.pdf
    • https://cdn.sqhk.co/talexadu/uZogdha/16958212952.pdf
    • https://cdn-cms.f-static.net/uploads/4392667/normal_602a04b6d85d9.pdf
    • https://cdn.sqhk.co/woberimi/haggbjc/pasta_before_a_soccer_game.pdf
    • https://cdn.sqhk.co/naxupowu/7qwijAd/k_yamet_kombat_arena_elmas_hilesi_2018.pdf
    • https://static.s123-cdn-static.com/uploads/4374980/normal_5ff5b7ecf318c.pdf
    • https://cdn-cms.f-static.net/uploads/4468553/normal_5fe716ca186c2.pdf
    • https://cdn.sqhk.co/wajerewuwer/a4jqhf1/luzojodejuselurifi.pdf
    • https://cdn.sqhk.co/dajuzafum/LKhgJgh/transparent_glass_screen_protector_iphone_8.pdf
    • https://static.s123-cdn-static.com/uploads/4487625/normal_5fe286ac330d0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fipijife/82224977009.pdf
    • https://6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com/ugd/12745a_5bcaf9ed2ed7475f9f6a0a03a658cef4.pdf?index=true
    • https://s3.amazonaws.com/xakusineba/windows_7_ultimate_64_bit.pdf
    • https://70010cfe-69b1-4fe9-a336-bdfe2418dc1e.filesusr.com/ugd/f1d680_9a8547b127ce4c2a87e2695e5c597a9b.pdf?index=true
    • https://s3.amazonaws.com/bolovopizonuki/ggplot_rstudio_cheat_sheet.pdf
    • https://s3.amazonaws.com/padosumifubobo/13828737992.pdf
    • https://899154e9-876a-4ab4-94d5-c8ef2aed10f2.filesusr.com/ugd/dcf9ad_e7a24d3af5e848b9abb819c15d0a2179.pdf?index=true
    • https://s3.amazonaws.com/nalifij/tikorozev.pdf
    • https://a86a6b26-b473-4b55-b9aa-7628a2bff077.filesusr.com/ugd/4f270c_931ed728255a4387b51b49042529edf7.pdf?index=true
    • https://s3.amazonaws.com/fokapikow/31695347827.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024d46.bin
8037bdf09c2c1cb8c74e28a3d42003fb30669ae279cc4b4e6026e92406257965		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24D46 5656 bytes
font_01_sfnt_off00026075.bin
29182f027df7282a71baac5cb3e18c3ee72cf12d596fbf6481e90dc950e71605		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26075 11824 bytes
font_02_sfnt_off00028906.bin
99ddc6f5858eb134f8024171ebe717cbd02485c31471b921a5021903b5272953		 pdf-font-stream PDF embedded font (sfnt) at offset 0x28906 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.