Malicious PDF — malware analysis report

Static analysis result for SHA-256 aca96eabb9eb0b8f…

MALICIOUS

PDF

97.7 KB Created: 2021-03-10 00:17:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2954c9b3442aa5cf2e6dd13795ca132c SHA-1: 752ceaf668846abad3c546f7d6a533d091ae0b70 SHA-256: aca96eabb9eb0b8f0aa665fbd7a46091e7cd3d2d7b9f5f2c771b5ae523d14b61
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The presence of external URIs and a 'download button' heuristic suggests the document is designed to trick the user into downloading a secondary payload. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall pattern indicates a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=domain+driven+design+pdf+github
    • http://hallop.xyz/nadoxetinugemagjc7q5.pdf
    • http://kinorio5.xyz/javusebuvorunokufapekirnl3kq.pdf
    • http://teagreen.space/932051440556t6kv.pdf
    • https://cdn-cms.f-static.net/uploads/4502248/normal_5fd377f964e46.pdf
    • http://pixerofojoka.22web.org/72505469326.pdf
    • https://cdn.sqhk.co/vizefejij/iiBSibO/final_fantasy_3_psp_walkthrough.pdf
    • http://lnstgramhelpcopyright.com/kiwiridelemuvamepozoxerajixs7.pdf
    • http://lestyprin.online/how_to_reset_my_sportcraft_treadmillqxaws.pdf
    • http://voztrans.ru/formulacion_3_eso_ejercicios_resueltswjsr.pdf
    • http://verifybadgesbusiness.com/granny_mod_apk_version_1._529p02.pdf
    • https://cdn-cms.f-static.net/uploads/4377403/normal_601be0b860663.pdf
    • https://cdn-cms.f-static.net/uploads/4454164/normal_6024231fc86a0.pdf
    • https://cdn.sqhk.co/vetukalujir/ggggH32/john_nes_apk.pdf
    • http://demask.fun/rigesi3b85y.pdf
    • http://mihetos.xyz/how_to_work_out_simple_and_compound_interestgrik9.pdf
    • http://thecabinets.xyz/185168515034oj11.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lovetijif/dusasekivojupe.pdf
    • http://sewesomepajava.epizy.com/why_the_rich_are_getting_richer_epub_download.pdf
    • https://s3.amazonaws.com/gavapozalilup/keralalugoxokaja.pdf
    • https://s3.amazonaws.com/jojitagifuva/87268553703.pdf
    • https://s3.amazonaws.com/vokeri/huf_pan_card_affidavit_format_in_word.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012bfc.bin
321218067013d167bba8a76caf5c9675a5cd7355da82d397b62bb6a72a9beb40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BFC 2872 bytes
font_01_sfnt_off00013638.bin
c55675cf6579287d7f70eacdbcb5a32971557a815de8bc6880daa4e2868bc8aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13638 5620 bytes
font_02_sfnt_off0001492d.bin
2a9ac8d286ef7762a69cb3e6ed07debbb6fe565956bfb57cacc3005a2bfe1d4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1492D 15172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.