Malicious PDF — malware analysis report

Static analysis result for SHA-256 a550b10a63af2959…

MALICIOUS

PDF

78.2 KB Created: 2021-04-03 07:23:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1bb6e4690735cb3a91ac9765249ad291 SHA-1: 82cd5248286799e61228d4e35728657d9de62e11 SHA-256: a550b10a63af29591ebfdfa4640c9eed87a106878ac8d9c39505d44d98e4d5df
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains an invisible link that directs users to a suspicious domain, likely to trick them into downloading a second-stage payload. The presence of a download button lure further supports the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=rogue+arena+guide+8.3
    • https://static.s123-cdn-static.com/uploads/4389074/normal_5fc90975dbdbb.pdf
    • http://study-english-02.space/average_american_income_per_person_2019vr564.pdf
    • https://cdn-cms.f-static.net/uploads/4468253/normal_603d5f6521955.pdf
    • http://securityofusersdevicesonline.site/draco_malfoy_age_in_harry_potter_half_blood_princeeaqup.pdf
    • https://cdn-cms.f-static.net/uploads/4476418/normal_604530521c9e0.pdf
    • http://sanatoriy-izumrudny.ru/interpreting_chemical_formulas_worksheet1qxwu.pdf
    • http://ludshop.xyz/4912977529154pqj.pdf
    • http://bestrongbyg.com/persepolis_book_2_analysisnb3vi.pdf
    • https://cdn-cms.f-static.net/uploads/4380530/normal_602ba593e8835.pdf
    • http://remont-pc.website/38224323427ocgij.pdf
    • http://toppiksnack.xyz/nizuj95o4o.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/933290c6-ac87-4c97-90af-5bdea740f714/42793664444.pdf
    • https://uploads.strikinglycdn.com/files/ade56895-8689-497b-aa9f-ae77fe1988a4/zenedejalulefoviz.pdf
    • https://uploads.strikinglycdn.com/files/30abd8df-1d3e-4106-9c28-c8d6e725c673/55968037611.pdf
    • https://uploads.strikinglycdn.com/files/159f3701-db05-481b-baa0-e608af025863/thinking_map_examples.pdf
    • https://s3.amazonaws.com/pegebunov/naloxebu.pdf
    • https://s3.amazonaws.com/fomudebipefasu/cisco_1800_series_router_configuration_guide.pdf
    • https://s3.amazonaws.com/sedowedi/110cc_4_stroke_engine_manual.pdf
    • https://s3.amazonaws.com/xoxaneral/59077197552.pdf
    • https://uploads.strikinglycdn.com/files/d791a8f4-6108-42a4-a9f8-dc8e8705663f/46105659043.pdf
    • https://uploads.strikinglycdn.com/files/221ba612-6048-42ab-a1b7-cb2d2b4684b9/free_academic_writing_course_for_phd_students.pdf
    • https://uploads.strikinglycdn.com/files/70bfe19a-0734-4398-a6db-85274fbe716b/clicker_universal_remote_garage_door_opener.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f200.bin
5680e5b76a7309f12f37fb5bb8729738a50099268c6faddc3c7860c6728e3a00		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF200 5180 bytes
font_01_sfnt_off000103ba.bin
e40d22aae60d8559b88eb5e6032e6a6f943339cc9ad0ff350582c6584371aaac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103BA 11672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.