Malicious PDF — malware analysis report

Static analysis result for SHA-256 9db51a82a2c1576c…

MALICIOUS

PDF

86.9 KB Created: 2021-02-20 23:56:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 905df5b4025df7db70f65bc8c2844bde SHA-1: b137319c73a7c352b2c339b64c09733a4a9012a9 SHA-256: 9db51a82a2c1576cbb29a30806b83ea573af6d8ad79f3864c1f94abfe9aba1e4
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it contains external URIs and a callback phishing lure, suggesting it's designed to trick users into calling a fraudulent number. While no scripts were explicitly extracted, the PDF structure and ML detection point towards a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/aws?utm_term=where+can+i+buy+panasonic+cordless+phone+batteries PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4378381/normal_5ff4888ac4dac.pdfIn PDF document text
    • https://sufusaripowo.weebly.com/uploads/1/3/1/4/131437865/7294390.pdfIn PDF document text
    • http://tixshopclub.fun/free_genogram_template_microsoft_wordk0zor.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490141/normal_5ff37006f33bd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393370/normal_602418dc53bd0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485800/normal_5ff1309e4702e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468270/normal_60118e6e3be42.pdfIn PDF document text
    • http://supermagazforsale1.xyz/48574956924y9ftj.pdfIn PDF document text
    • http://badge-verification-center.com/17227998169jshzb.pdfIn PDF document text
    • https://sexedevojaboto.weebly.com/uploads/1/3/2/6/132695366/xawifid.pdfIn PDF document text
    • https://fajizaxaro.weebly.com/uploads/1/3/1/3/131381717/7098808.pdfIn PDF document text
    • https://vurikiwuguwek.weebly.com/uploads/1/3/1/4/131408439/vesuwixibegusatefo.pdfIn PDF document text
    • http://retys.fun/baixar_jogos_para_ppsspp_gold_androidkxygn.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jidagafinuxesu/lobuzimizisugog.pdfIn PDF document text
    • https://s3.amazonaws.com/musoxifuvitalo/9434156907.pdfIn PDF document text
    • https://s3.amazonaws.com/dedinavesute/latest_bollywood_movies_hd_khatrimaza.pdfIn PDF document text
    • https://s3.amazonaws.com/resabomibogodaw/51161499317.pdfIn PDF document text
    • https://s3.amazonaws.com/gosete/les_saisons_en_francais_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/befafuni/server_bitcoin_miner.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107A7 5296 bytes
SHA-256: 0c55c4413b6da8d7d72158664070c6fb8f5fdcd1220777f7a420c36404e80638
font_01_sfnt_off0001199e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1199E 11224 bytes
SHA-256: 43d85a43f7e4b7ffa1d47eba5757ba3007da9996e1c36b848d89be0ff6f20530
font_02_sfnt_off00013fbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13FBB 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.