Malicious PDF — malware analysis report

Static analysis result for SHA-256 a12de4fbce9cfcfd…

MALICIOUS

PDF

353.3 KB Created: 2021-03-16 09:09:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 8c130ff99ee27cd4b7162999c45fef07 SHA-1: b05deaa31dfbe78708a6b5821cf38392c83e7f37 SHA-256: a12de4fbce9cfcfd53c993d27ca907cc64866afee2df2eee5a79ecf41b3b75c8
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, and contains heuristics indicating a browser extension installation lure. The embedded URL points to a domain that has been associated with phishing and malware distribution. While no scripts were directly extracted, the nature of the lure suggests an attempt to deliver a malicious payload, likely via JavaScript execution within the PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=plant+and+animal+adaptations+worksheet+pdf PDF link annotation
    • https://cdn.sqhk.co/korulifesewa/ndhdgfQ/vijepek.pdfIn PDF document text
    • http://sewatumafuta.medianewsonline.com/sciatica_nerve_exercises.pdfIn PDF document text
    • https://cdn.sqhk.co/perokokamosa/m0Wa7id/capsaicin_cream_0._025_en_espanol.pdfIn PDF document text
    • http://lutafem.getenjoyment.net/bhakti_yoga_in_kannada.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/feliso/karate_gi_pattern.pdfIn PDF document text
    • https://b304dada-1952-41b2-af44-d16a3232bb3f.filesusr.com/ugd/c19c34_30d42d5c2e1143f8a237bb771e89d3eb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/difigomisosak/fexozogumumuxunejumipe.pdfIn PDF document text
    • https://95a57b4d-a24c-4412-bd87-88f4f885d252.filesusr.com/ugd/011e4b_8a674fd867924f46935fb67978431d83.pdf?index=trueIn PDF document text
    • https://f8ba888e-8f71-4fde-8303-550399648f4e.filesusr.com/ugd/17ce20_1fe9977fde934b3194426358636b3d33.pdf?index=trueIn PDF document text
    • https://95043331-d9de-4498-ad98-35b8ac3ee23f.filesusr.com/ugd/5740b2_cfa281c18f0b47199a30419fb6ce4ce5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wegemebufojafak/52581906637.pdfIn PDF document text
    • https://s3.amazonaws.com/vanatul/call_me_by_your_name_cherry_red_vinyl.pdfIn PDF document text
    • https://s3.amazonaws.com/mefovu/48765959979.pdfIn PDF document text
    • https://s3.amazonaws.com/kovezux/wadejokoxe.pdfIn PDF document text
    • https://s3.amazonaws.com/poresi/phyllo_dough_sheets.pdfIn PDF document text
    • https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_9bfe05a7cc074ee0bff79983607cdba2.pdf?index=trueIn PDF document text
    • https://e437b920-fa79-41d5-b67c-0ca059f4e77a.filesusr.com/ugd/d97c10_2c31cb1345664e35871cf4989ed763f0.pdf?index=trueIn PDF document text
    • https://c84d532c-3b33-47d6-96aa-4134a1164eb1.filesusr.com/ugd/6d45f6_94160ef1941d4e429dd35c718b1d0368.pdf?index=trueIn PDF document text
    • https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_c3158e82681c445e8d2aef3193c1573e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0001b4d0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B4D0 311120 bytes
SHA-256: a94de0efad587a62cd772e07ef473d9d80a61fb04555e6f4e0441cb2ce195273
font_01_sfnt_off00053da7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x53DA7 5436 bytes
SHA-256: 243d8d97519a33d859692a61b8f7dbdb9589df4944ced447d0fe328d9e930edb
font_02_sfnt_off0005500a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5500A 11568 bytes
SHA-256: 9b8155acfef383c7315093225e0077fc3ee86e80fec650256c004d2d069196a7

Open this report in the interactive analyzer, or submit your own file for analysis.