Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a57d7dc8e513f40…

MALICIOUS

PDF

82.4 KB Created: 2021-04-05 08:03:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6003e57ac7c79861718f3f80002b72ef SHA-1: 77a38004de997dc2e621ab6fe615c4e9f114df1d SHA-256: 9a57d7dc8e513f402115ab3449d63b9f57b255b512d8676de8d6d5a5b9517747
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, likely intended to trick users into downloading malware. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may instruct users to open a password-protected archive, a common tactic to bypass security filters. ClamAV also detected this file as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=eraser+free++for+windows+8.+1
    • http://piwulag.sportsontheweb.net/maliragupogiza.pdf
    • https://lexawuvake.weebly.com/uploads/1/3/4/6/134610488/2291683.pdf
    • https://melenoradu.weebly.com/uploads/1/3/4/3/134340649/d21987d0140.pdf
    • http://bovizanaranofo.22web.org/xuwazatod.pdf
    • https://cdn.sqhk.co/gixedomawa/QgiJh6P/ribonunewemadedavix.pdf
    • http://kozugufasuroti.mygamesonline.org/nysc_registration_form_template.pdf
    • https://cdn.sqhk.co/miburixegapu/bvgdAgG/paxivolukujevefum.pdf
    • https://cdn.sqhk.co/zetoxezoza/ax4ijK6/24862243761.pdf
    • http://mizizufiku.mywebcommunity.org/zojevu.pdf
    • https://cdn.sqhk.co/bafesugoguwi/e4Qhaih/alone_status_in_english.pdf
    • http://gijaninapumobe.sportsontheweb.net/34724875399.pdf
    • http://xawegap.mywebcommunity.org/78370035708.pdf
    • https://cdn.sqhk.co/kosadara/TibPjji/minetest_online_server.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://berowajadodi.epizy.com/analfabetismo_en_colombia.pdf
    • http://luwefotikejumu.rf.gd/battlefield_4_gameplay_pc_free.pdf
    • http://wenibeliso.atwebpages.com/characteristics_of_programming_language.pdf
    • http://vekejuf.atwebpages.com/61365195164.pdf
    • https://uploads.strikinglycdn.com/files/648eb4ee-c9ce-4ddc-b644-71d0067a61a7/garbh_sanskar_book_in_marathi_app_download.pdf
    • https://uploads.strikinglycdn.com/files/e910d5e2-410c-4a17-b16a-b2836f71a7e2/27376243040.pdf
    • http://bimidiwokave.epizy.com/which_of_the_following_is_not_true_regarding_transnational_corporations.pdf
    • https://uploads.strikinglycdn.com/files/049246b7-6c8e-499f-a505-8f80a6fa639a/toshiba_satellite_c850_touchpad_driver_windows_7_64_bit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001057c.bin
d8f88fc67d7bcecfb25e747ed355517400053749af9c9d6d2c3dce58cdcfaaf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1057C 5196 bytes
font_01_sfnt_off00011755.bin
b8ebaccb0e9f68b5dc974155ec2de819ae535a6de36eddfec72efe79572d2632		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11755 10860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.