Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3d330be7b3f515f…

MALICIOUS

PDF

81.1 KB Created: 2021-03-14 09:24:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6b3331510b53ae8ac542178d17568890 SHA-1: 72718024a970c61fb9f23382326b24db8a76f6c3 SHA-256: a3d330be7b3f515f41c22710023a1a906698d6e1ad3977477952952068412a30
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains embedded URLs and a heuristic indicating a visual download button lure. The presence of external URIs suggests an attempt to redirect the user to download a secondary payload, likely a trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=note+9+android+10+firmware
    • http://devicesprotectionforusers.site/opera_browser_latest_apkcku7z.pdf
    • http://uplrezina.site/fejurambhzy2.pdf
    • http://dontbeshy.xyz/xopugotonowapiwe38dj8.pdf
    • http://zyzycheat8.xyz/can_you_use_playstation_3_controller_on_ps4j5lzc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2b08c346-38d8-4763-b559-bb9d4fff2313.filesusr.com/ugd/40c9d6_27c1634736dc4ed38778ae77823b621a.pdf?index=true
    • http://jomovexujufadi.epizy.com/56966413594.pdf
    • https://s3.amazonaws.com/fakuguvil/pinugagajupixewiv.pdf
    • http://pemuvem.epizy.com/what_is_considered_middle_class_income_in_ontario.pdf
    • http://kagilabitivibe.epizy.com/mexodivozedijereto.pdf
    • https://uploads.strikinglycdn.com/files/abca57fe-51c5-4022-9207-5df77d3c2f4a/dofewizunerete.pdf
    • http://zezewesiwakoruw.rf.gd/agrotoxicos_e_meio_ambiente.pdf
    • http://lifarodanudu.rf.gd/ashoka_chakravarthy_movie_audio_songs.pdf
    • https://s3.amazonaws.com/tizowodifi/duwufakot.pdf
    • https://uploads.strikinglycdn.com/files/27c94890-804f-4c67-8721-3a62b44f56c3/dance_music_songs_1990s.pdf
    • https://8717ace1-8174-44a1-9f98-e7cbf9e9ed94.filesusr.com/ugd/14e3be_01dc1b5d8048431e804fedc83a48ed92.pdf?index=true
    • http://denawovusu.rf.gd/integrate_e-x_cos_2x_dx.pdf
    • http://sanuranivewozos.epizy.com/millermatic_135_parts.pdf
    • https://s3.amazonaws.com/zuniverijesud/90839738524.pdf
    • https://d8d691c7-cf48-432b-bece-a54604b57851.filesusr.com/ugd/1e3a4b_97769d9636714eb3b129a404c258a80e.pdf?index=true
    • http://xasiruzate.rf.gd/sociology_dictionary_for_upsc.pdf
    • https://uploads.strikinglycdn.com/files/dfeddc3c-a984-410f-b20c-7d438cd7de6b/87245746408.pdf
    • https://s3.amazonaws.com/wozowuledij/3442663158.pdf
    • https://uploads.strikinglycdn.com/files/2c8e7040-f267-45ba-8e7c-da01dd0f4888/pefuxeniv.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4ae.bin
5d615f14ffe1a69560f0fa5ebaf618fdf241a000acaa2d1acec6428a2731f0cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4AE 5252 bytes
font_01_sfnt_off0000f696.bin
8ccede503b3d3dcccfdd9e4ab813a0ad76fc4348ac49e11a65acc4c2ffc9ca41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF696 12668 bytes
font_02_sfnt_off0001205a.bin
6037a04ed303ce5f8b31946a2dce905ed2587e35b9275d065270658485c61920		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1205A 16480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.