Malicious PDF — malware analysis report

Static analysis result for SHA-256 a37d85dde6d5fdcb…

MALICIOUS

PDF

80.2 KB Created: 2021-04-17 04:07:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 22420b3e89b17cf7af490f56dd0c53e5 SHA-1: b5aff6d327c3e6a85f0510faa439278897ded2ee SHA-256: a37d85dde6d5fdcbef393f8b9bc583a98636fa0f2f58e6210ea8940b8591b20a
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ML classification and ClamAV, indicating malicious content. The 'SE_CALLBACK_LURE' heuristic specifically points to a callback phishing or tech-support scam pattern, where the document likely prompts the user to call a number. The embedded URL 'https://midufefew.ru/strik?utm_term=whirlpool+oven+repairman+near+me' is the primary indicator of a malicious external resource, likely used to host or redirect to the scam's landing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=whirlpool+oven+repairman+near+me PDF link annotation
    • http://basidugom.mygamesonline.org/moweg.pdfIn PDF document text
    • http://poxumanavofeboz.scienceontheweb.net/lds_2020_general_conference_trailer.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450417/normal_604ccee3f141b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471688/normal_5fc6d931be403.pdfIn PDF document text
    • http://nakomajuvedina.iblogger.org/why_wont_my_hamilton_beach_flexbrew_work.pdfIn PDF document text
    • http://gakukuketisalum.scienceontheweb.net/45364701337.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/1df9fd51-316c-48ca-bf7e-ae5112cf0329/34780036370.pdfIn PDF document text
    • https://s3.amazonaws.com/rovikibixu/9588647294.pdfIn PDF document text
    • https://s3.amazonaws.com/donukadizolin/zajekud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ac23ce5-60ff-4167-af85-2da44af2ef79/difference_between_murder_on_the_orient_express_movie_and_book.pdfIn PDF document text
    • https://s3.amazonaws.com/budovewesekaz/14304118003.pdfIn PDF document text
    • http://redifigikutusoj.myartsonline.com/roremetiwudivazexamope.pdfIn PDF document text
    • https://s3.amazonaws.com/muxegeza/tupozetetobotavesubewema.pdfIn PDF document text
    • https://s3.amazonaws.com/vatosolikijike/20622054579.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6bc94de1-b70f-4ecf-b446-11262fc1c785/can_you_make_a_free_wordpress_website.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd108555-6da1-4f47-8d3b-83806bab55d2/kenmore_elite_portable_air_conditioner_12000_btu.pdfIn PDF document text
    • https://s3.amazonaws.com/tujeviwakirawu/denon_avr-3808ci_subwoofer.pdfIn PDF document text
    • http://tojopoxirer.rf.gd/43247445246.pdfIn PDF document text
    • https://s3.amazonaws.com/wujapu/decoding_the_weather_machine_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/what_is_the_positive_and_negative_impact_of_globalization_on_culture.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eff5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFF5 4664 bytes
SHA-256: 45d25cb7c5ffbea0f3e3c83dcd2f760aef789cfa21183e22799ed6d13f74bf93
font_01_sfnt_off0000ff8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF8F 10896 bytes
SHA-256: 9396949da143d5ee2cada81f59b2726edac68d5503e1bbc73e3cfc0042d63093
font_02_sfnt_off000124d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124D8 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.