Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3f6784b265e7698…

MALICIOUS

PDF

173.3 KB Created: 2021-04-01 08:15:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 91afe89023e8be61a84a992f86b66193 SHA-1: 324b12911e710caddc64147b6e592f9e928609e1 SHA-256: a3f6784b265e76982f1ac43378eced9ddd67c2fca50be77840fa3cde7e431608
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'action potential neuron pdf'. No scripts were extracted, but the presence of external URIs and the malware classification strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=action+potential+neuron+pdf PDF link annotation
    • http://natosabi.mygamesonline.org/plan_de_auditoria_interna.pdfIn PDF document text
    • http://vetovikaxu.mypressonline.com/tally_all_voucher_entry.pdfIn PDF document text
    • http://penageli.getenjoyment.net/87454346034.pdfIn PDF document text
    • http://jirusulixozome.scienceontheweb.net/84590337683.pdfIn PDF document text
    • http://bomaduworofa.medianewsonline.com/where_can_i_donate_gently_used_toys.pdfIn PDF document text
    • http://xibiselid.medianewsonline.com/skyrim_se_skyui_error_code_4.pdfIn PDF document text
    • http://gedadekenoz.mywebcommunity.org/romeo_and_juliet_movie_1996_mercutio.pdfIn PDF document text
    • http://memimusisat.getenjoyment.net/how_many_books_are_in_the_wimpy_kid_series.pdfIn PDF document text
    • http://wedevaz.sportsontheweb.net/fapawadapamodu.pdfIn PDF document text
    • http://fozivot.mypressonline.com/libros_de_administracion_turistica_y_hotelera.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/lakadutof/zisimunenumabanaw.pdfIn PDF document text
    • https://s3.amazonaws.com/pusori/36092060837.pdfIn PDF document text
    • https://ecf8b3bd-8201-449f-a39c-156acd88681e.filesusr.com/ugd/97634b_0553fbc97e544a61908414c9d9b558b0.pdf?index=trueIn PDF document text
    • https://602af194-5307-4bd7-bf09-435e6df32b58.filesusr.com/ugd/bf07b1_a1c3d5d5944e4febaa4e82c448fbf7e9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zarelusipofox/yeh_bhagwa_rang_video_song.pdfIn PDF document text
    • https://s3.amazonaws.com/wefadep/how_do_you_use_a_blender_step_by_step.pdfIn PDF document text
    • https://71b4061d-0fbe-47a8-a671-08758978b022.filesusr.com/ugd/0216f2_26b0de761fe04ece8e84c1fc3cc05103.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/ratixifo/julekumutawojefifitov.pdfIn PDF document text
    • http://sajulugebimisu.myartsonline.com/contract_costing_examples.pdfIn PDF document text
    • https://13a2bf7a-7930-4518-a7e6-737bf3c0aa4f.filesusr.com/ugd/f5c1a0_9f7ad90a1ea94219b0d7b5f2c149a892.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024356.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24356 4844 bytes
SHA-256: 5835f250738290a6f598304af4329e7cc88eea0cd4b96ca382b4db99ae8012bc
font_01_sfnt_off000253cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x253CD 14688 bytes
SHA-256: ae28e3e18ee6eb0b543ca99acec4f4a6a0a1417f09eb961e49afc7d2eb0c0e3f
font_02_sfnt_off0002841a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2841A 16192 bytes
SHA-256: c00f55c8a23f8fc12478e3e4ea1bac713d25e4d1dd6e1e4bb5c667610ba6b2cf
font_03_sfnt_off00029946.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29946 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.