Malicious PDF — malware analysis report

Static analysis result for SHA-256 87851563648b2a3c…

MALICIOUS

PDF

72.3 KB Created: 2021-04-16 05:43:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 34948b9569c78dc9619271253b556890 SHA-1: d617947223c8655e9cb01fd86428c29d536d575c SHA-256: 87851563648b2a3caa15b60c18577cb75c1afe22a40330f179a473471c998a5c
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a ClamAV signature and an ML classifier, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text related to "Totaline thermostat unlock," suggesting a lure. The presence of an external URI pointing to 'maypoin.ru' further supports a phishing or malware distribution vector. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document may be part of a multi-stage attack involving encrypted archives.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=totaline+thermostat+unlock PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4389355/normal_5ff953f95889a.pdfIn PDF document text
    • http://gagarinski.su/60347886324gpqms.pdfIn PDF document text
    • https://lirefabagobaxi.weebly.com/uploads/1/3/4/0/134012393/22baadd7.pdfIn PDF document text
    • https://kusonanozeko.weebly.com/uploads/1/3/0/7/130775507/759737d1b8.pdfIn PDF document text
    • http://trendmobile.ru/76833825805d8y9y.pdfIn PDF document text
    • http://okclub.org/what_is_a_dapple_dachshund_mixed_withwv0jf.pdfIn PDF document text
    • http://mapitunokon.22web.org/agnes_martin_lugand.pdfIn PDF document text
    • http://scandisvet.ru/joxuputuzugiwufst2yc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372373/normal_5fd7a42432ae0.pdfIn PDF document text
    • http://2220202.ru/how_long_does_it_take_to_learn_tattooingk03h5.pdfIn PDF document text
    • http://uablog.site/diksiyon_kitaplar41d9i.pdfIn PDF document text
    • https://tugajepefur.weebly.com/uploads/1/3/1/4/131453805/b40be46.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vibuvomomuv/wolewolokinunipuno.pdfIn PDF document text
    • http://rixupod.rf.gd/turivopubixiga.pdfIn PDF document text
    • https://s3.amazonaws.com/lonozote/wafapoxabuxevavupogekoba.pdfIn PDF document text
    • https://s3.amazonaws.com/jedadokuti/casio_5208_aq-s810w_battery.pdfIn PDF document text
    • https://s3.amazonaws.com/sikuva/49688266043.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE5C 5052 bytes
SHA-256: a2e2b599a7d55ad2cb18b731f43fdbb3437759fa6f6a081027db89a5528e7852
font_01_sfnt_off0000ef57.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF57 10868 bytes
SHA-256: f3379c083f72ad719e9ed3459d61c2470d66ecd45644111403cf2be3e7de85d7

Open this report in the interactive analyzer, or submit your own file for analysis.