Malicious PDF — malware analysis report

Static analysis result for SHA-256 a782c00afaefbd2e…

MALICIOUS

PDF

81.9 KB Created: 2021-04-01 06:12:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8d1eb8df89be4a8035543077f464dc83 SHA-1: 2f86a5f470ef1858b0449768b65cde0f3af1b430 SHA-256: a782c00afaefbd2e1bf4b8e16dc30e4009f6de0c21f52c667b04140db9d0ab30
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The presence of an embedded URL and a heuristic indicating a visual download button suggests a social engineering attempt to trick the user into downloading a payload. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a syllabus, aligning with a lure for a malicious download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=crsu+b.+ed+syllabus+2017-+19+pdf
    • https://static.s123-cdn-static.com/uploads/4415519/normal_5fe2931938a6b.pdf
    • http://benotapinaz.iblogger.org/dusolimo.pdf
    • https://static.s123-cdn-static.com/uploads/4409093/normal_6001a4f02054e.pdf
    • http://lukufogud.getenjoyment.net/felojebenat.pdf
    • https://cdn.sqhk.co/rowalulo/ijjuie2/10331481126.pdf
    • https://cdn.sqhk.co/wazafanez/gibWjg7/delagopofevatodedixusexud.pdf
    • http://bowuvudofi.scienceontheweb.net/vugaxoxanapebuz.pdf
    • https://cdn.sqhk.co/puxolika/fl2hjid/download_citra_3ds_pro_apk_for_android.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_850276432b4247c191d63db08876b01d.pdf?index=true
    • https://217ba8a6-026c-4a9e-b1ce-2eadff0a4a08.filesusr.com/ugd/3d7af5_67f10d9d89844de3bb536cc535f30daf.pdf?index=true
    • http://dinotowiteve.rf.gd/depression_era_recipes_menu.pdf
    • https://ab60d57a-1f92-408f-9079-0b325776b613.filesusr.com/ugd/724fb5_35e74399aeeb4859895c4a0a3d2eb419.pdf?index=true
    • https://1fc3e790-19e1-43b7-bae7-d09a953f51fe.filesusr.com/ugd/2c608b_d368be9ea665424289ea1672c2966c58.pdf?index=true
    • https://76f5a3e5-08d8-4581-9975-6c1b933a1845.filesusr.com/ugd/dbbd16_97f2cbe9c5684d77a4625027ae2d0957.pdf?index=true
    • https://87164119-88a6-4d6d-a72f-b109cf2d88b9.filesusr.com/ugd/bd0a66_b7d92a49b7624b0486bb3400135d4cb1.pdf?index=true
    • http://pikididubemet.epizy.com/94776456205.pdf
    • https://e809654a-a95b-4dbc-a338-24085255a2f8.filesusr.com/ugd/1b6cec_cb0ff6363f0d456f9528e62d5cf11fd8.pdf?index=true
    • https://64b67c6e-fbbd-4787-add8-9ed3e274c95c.filesusr.com/ugd/eb6612_fedf6cc36c3b4c48bdda29e334811db6.pdf?index=true
    • https://dc688580-c0ec-4ade-910b-7abffd870ab4.filesusr.com/ugd/096b61_918cbbe19ba448f196d585762218cd5b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000126f8.bin
9e314f5c7ee165dfcb30d14db79fd1bef4a5cfa4bb1ea26234754be6ebf928ec		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x126F8 5480 bytes
font_00_sfnt_off0000ed4c.bin
910577f5692a69cbf4cc1c4b9511c50bbab75675e395cb811d24cf8ab655d6d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED4C 5808 bytes
font_01_sfnt_off00010138.bin
dee456c9787eb92eeee46ae40e5cb0a28c3bf7185637a9b0a7c4d16c26e9b922		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10138 11000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.