Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6d9733961b62d0b…

MALICIOUS

PDF

132.2 KB Created: 2021-03-16 04:49:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: 4b10a627f4a298da59e4b0a69687857e SHA-1: 2260cc64b664694c2d5f44990c72853ee44516e2 SHA-256: a6d9733961b62d0bc05272ed24b02ecf2cb49f89e16ffc66129ce9430f9a5020
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified as a phishing or malware distribution attempt by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to 'CPR guidelines 2020 pdf', likely intended to trick the user into downloading a malicious payload from the linked URL. No scripts were extracted, but the presence of external URIs and the ML detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=cpr+guidelines+2020+pdf PDF link annotation
    • http://insurancesouk.com/how_long_does_ti_ba_ii_plus_battery_last2qkg4.pdfIn PDF document text
    • http://axecheat9.xyz/2082442657jlqp0.pdfIn PDF document text
    • http://podeves.xyz/mu_cv_ting_vit_hayl514x.pdfIn PDF document text
    • http://classkaod.ru/what_level_is_nate_the_greatdw52g.pdfIn PDF document text
    • http://table-wait.com/reduce_to_its_simplest_form_synonymw8zs1.pdfIn PDF document text
    • http://sanatoriy-izumrudny.ru/what_is_les_misrables2zbyw.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/6374ba39-8220-4522-9fba-a9052571630f/81887268382.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/533ccc39-5fdc-49ec-b156-593cc0f918a5/black_and_decker_18v_battery_charger_replacement.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa052170-ee8c-469d-9ccd-ece0bfe31e91/malarow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/460398c2-dc1b-4ff2-b2a2-f8989afcaa75/dimelivupoxositi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f72a5616-af79-4a06-9d52-91ee23786ce1/93131029971.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c9b8aa7-a9a5-4e32-a031-eb0a26527095/words_have_power_read_a_banned_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7bd814e4-af9c-484c-9429-42eb32ba08ca/the_road_movie_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69d2e1de-0fde-4653-9f9d-49121879c8b1/what_kind_of_oil_does_a_subaru_pressure_washer_use.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9118f46-4f33-46a7-8764-b4cb24c13629/dutizabulodajosikupiti.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33ceecd3-c747-460f-85ef-f33014593355/sony_str-dn840_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fdcd9d85-32dc-46f4-b432-3229c952dc17/bonugaxutorisivegat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d929e0c0-c4f9-44c5-b24a-0669a9565bc0/save_the_cat_beat_sheet_movie_example.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/271d8d16-1be6-48ab-80b6-030dff888fa9/75372204070.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b55d882-bcd1-448e-9080-49739742108a/space_place_and_gender_identities_develop_pre-600_bce.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1ff78df-7d0f-417e-a93b-50f3805846d8/berenstain_bears_books_collection.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1f3c890-52e9-409a-b23c-28aee5899063/casio_wk_220_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a88b9af-67b2-46a9-9a3b-9a56386fa831/is_fossil_watch_waterproof.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001bbd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BBD3 4988 bytes
SHA-256: d83658f2dfde8af205b459c5bef86e20402dfc2cd1577d6c46be2bd887eeb5de
font_01_sfnt_off0001ccd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CCD3 12060 bytes
SHA-256: 2cc00786cc3bfc48b8c0ead7a19f7a2ad877b4162812952b3e9a79d5fbe942b7
font_02_sfnt_off0001f4d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F4D1 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3