Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7c35815c452d4cf…

MALICIOUS

PDF

177.2 KB Created: 2021-04-16 18:54:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: af28c7e42178a57a4c3725d8312c7d1c SHA-1: 29cbb58abe234fe5aefada6667440e544b56e679 SHA-256: a7c35815c452d4cf1c143944e74abe3b36a2bc4f9b770b920b3dff618ed675da
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains references to a game show and a URL, suggesting a lure. Heuristics indicate a callback phishing attempt, where the user is prompted to call a number in a context of billing, refund, or security issues.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=ellen+game+show+channel+on+directv PDF link annotation
    • https://cdn.sqhk.co/dipewoduge/jehjeWU/president_speech_live_enca.pdfIn PDF document text
    • http://ruguwafe.scienceontheweb.net/budidaya_bunga_telang.pdfIn PDF document text
    • https://cdn.sqhk.co/miwizawi/cjiHpMW/car_race_games_for_pc_windows_7.pdfIn PDF document text
    • https://cdn.sqhk.co/dagorabowixu/hiihLjj/abc_thai_song_mp3_download.pdfIn PDF document text
    • http://raguvigawak.mypressonline.com/fuwasorasomugadufetedodin.pdfIn PDF document text
    • http://pasiworuwiwoz.getenjoyment.net/66839278068.pdfIn PDF document text
    • http://tesupelaj.sportsontheweb.net/60472241022.pdfIn PDF document text
    • http://gamukanemafutu.mywebcommunity.org/berliner_platz_a2_neu.pdfIn PDF document text
    • http://kapabifidi.sportsontheweb.net/90878207498.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://20097937-9b7a-4da4-851c-33e9a8906939.filesusr.com/ugd/1e3518_cf72a727c2094d6fa0a5173711280117.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fadobirak/asrock_n73v-_s_ethernet_driver.pdfIn PDF document text
    • https://625f08e2-3d8e-45b5-8e8c-b95d001c5c7c.filesusr.com/ugd/d94ae5_172c13cd537842e6840877b0447370bf.pdf?index=trueIn PDF document text
    • http://futebowa.atwebpages.com/amino_acids_table.pdfIn PDF document text
    • https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_cd8b420bf4b6425b9b0476aa8ab345ef.pdf?index=trueIn PDF document text
    • http://namepafubi.atwebpages.com/barron_s_sat_subject_biology.pdfIn PDF document text
    • https://s3.amazonaws.com/sobaketemu/ninaz.pdfIn PDF document text
    • https://s3.amazonaws.com/kovozenamofox/5918693756.pdfIn PDF document text
    • https://s3.amazonaws.com/xopugup/pofofegamikum.pdfIn PDF document text
    • https://4c5ad993-366d-4b3a-aa99-9b6f56583180.filesusr.com/ugd/01e791_02a9bfde3e0e447395012c549b8fd1db.pdf?index=trueIn PDF document text
    • https://625f08e2-3d8e-45b5-8e8c-b95d001c5c7c.filesusr.com/ugd/d94ae5_580c93bb6da14c088c6882959a8cff11.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/remeranexe/image_gallery_blogger_template.pdfIn PDF document text
    • https://s3.amazonaws.com/toliwudalamem/the_eft_manual_gary_craig.pdfIn PDF document text
    • https://s3.amazonaws.com/mupukesunobaga/do_ikea_have_king_beds.pdfIn PDF document text
    • https://s3.amazonaws.com/gedexim/46914335239.pdfIn PDF document text
    • https://s3.amazonaws.com/mipeboro/quadratic_function_graphs_worksheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000269ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x269CE 3464 bytes
SHA-256: 09245aa0817544f4d01fa497d19afbd2b5d5387440ee0e5273c1194569f9c43c
font_01_sfnt_off00027652.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27652 5460 bytes
SHA-256: 6dda2345888768094f1f0b9c5605e428902a4e1bd615ba7e038ddf95db463bab
font_02_sfnt_off000288d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x288D8 14520 bytes
SHA-256: faf9ca6f4b73aad2c795d21b1f6531854130fad892d1135c5f6b728681fe2670

Open this report in the interactive analyzer, or submit your own file for analysis.