Malicious PDF — malware analysis report

Static analysis result for SHA-256 96e7e6671c6ffa2e…

MALICIOUS

PDF

171.7 KB Created: 2021-03-09 03:22:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: b6c21d804bd7ecb18f9ff47fe6f76df4 SHA-1: da33f35df5338986eb05fd4f4ed741c7523317fd SHA-256: 96e7e6671c6ffa2eb9572e688262b8ad423f354194a762a2ddcf52a3863aa0c0
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The sample is a PDF document flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it impersonates cloud document services and contains an external URI pointing to a suspicious domain, likely for phishing or malware distribution. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of an external URI suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=electronics+projects+for+beginners+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4413363/normal_5fe52dc6a4587.pdfIn PDF document text
    • http://vekenuv.iblogger.org/gusuvepitagajanimujidu.pdfIn PDF document text
    • https://jizotigop.weebly.com/uploads/1/3/0/8/130874082/databusexu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448337/normal_6020da758d034.pdfIn PDF document text
    • https://rorawakufajixe.weebly.com/uploads/1/3/4/6/134653883/5f33122364a3d1c.pdfIn PDF document text
    • https://vizazoxo.weebly.com/uploads/1/3/4/6/134600102/laveti-bisuluniw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416659/normal_600c39f4ab1c8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366017/normal_601000d4b25c8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465249/normal_60069c112ff18.pdfIn PDF document text
    • https://taxamoxegira.weebly.com/uploads/1/3/4/8/134895948/gebowuzatekojukevexe.pdfIn PDF document text
    • http://dokelamalide.iblogger.org/69169681591.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dusubonifu/hedging_instruments.pdfIn PDF document text
    • https://d6d3a1c5-32ce-46e9-ae92-c5b8d84d65d9.filesusr.com/ugd/a3b54b_3cbf09b547fe4de5afcf1f598e0d64db.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tokit/10359233740.pdfIn PDF document text
    • https://s3.amazonaws.com/zafijukopa/blur_background_image_android_xml.pdfIn PDF document text
    • https://s3.amazonaws.com/benuka/come_si_ci_presentarsi_in_inglese_formale.pdfIn PDF document text
    • https://s3.amazonaws.com/wogikokuzotaxa/tree_leaf_brushes_photoshop_free.pdfIn PDF document text
    • https://18cb0a1d-3822-48a5-9ca0-56465202bc9b.filesusr.com/ugd/96564c_cb3b2445efbb4345a85f511a765749e9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/suxuzubojut/26733602842.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00024e8b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x24E8B 14352 bytes
SHA-256: c10d7844b1704caf47440e5591b39b0c9a58404255f0032d15cb7a35dfe38935
font_00_sfnt_off00023c83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23C83 5288 bytes
SHA-256: ccabfa42b4f29d77e30430c2bb1b2fc509c6265d58aa54d8d7fa924491cb16da
font_02_sfnt_off000276b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x276B5 12280 bytes
SHA-256: f8cac822e031dbd99a0235299f5ab8ee280e467c0bca3b7dd4bc1f524a0df94a

Open this report in the interactive analyzer, or submit your own file for analysis.