Malicious PDF — malware analysis report

Static analysis result for SHA-256 b104a84fd2c2909f…

MALICIOUS

PDF

82.7 KB Created: 2021-05-12 00:15:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 66d065227f084e90ae848a3fd2fe461c SHA-1: 2b7bfbe1e828c2362974afab03286b0fb241383c SHA-256: b104a84fd2c2909fbe516256d969933fb9c0d38882f8e773b70a0728aa1c54a6
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic indicating it's a password-protected archive lure, suggesting a phishing or social engineering attack. The embedded URL points to a suspicious domain, likely intended to deliver a malicious payload. ClamAV detection and ML classification further support its malicious nature. No scripts were extracted, but the overall pattern suggests a phishing attempt to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=anti+deep+freeze+7.00+020+free+download+for+windows+7 PDF link annotation
    • https://lopuxewununoj.weebly.com/uploads/1/3/4/7/134748711/jubavodalowa_xiviji_fodaw_bosasugajowis.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369933/normal_6002bada6e2a4.pdfIn PDF document text
    • https://fidovasunub.weebly.com/uploads/1/3/0/8/130815093/6974109.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500438/normal_60543b9f1e56f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495526/normal_603130069f7c5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446289/normal_5fdc71ab02d8e.pdfIn PDF document text
    • http://paxosij.mygamesonline.org/calculus_purcell_9th_edition_indonesia.pdfIn PDF document text
    • http://wewofif.scienceontheweb.net/detailed_lesson_plan_for_kindergarten_math.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366359/normal_604a24aa1e7ac.pdfIn PDF document text
    • http://xepuxupipe.mywebcommunity.org/glass_sword_quotes.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wibedubosateg/maintenance_planner_engineer_interview_questions_and_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/wuwabobujasivor/super_bomberman_for_pc.pdfIn PDF document text
    • https://9fbeb193-358d-48fe-b9d9-45f8b63f6b3c.filesusr.com/ugd/ab67b9_bf23e434e92342a6a105b1d66f2a165f.pdf?index=trueIn PDF document text
    • https://55afd15b-9a96-48ff-beb6-d705f4765584.filesusr.com/ugd/8b06a9_2c57b9b566794075ab1cc9b7c3e0eb53.pdf?index=trueIn PDF document text
    • https://cf62593c-3f62-494e-9ef9-3c2a63ead7d7.filesusr.com/ugd/93dae2_0b7148b71c4d44b382bf21de7b9435cb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0046a3e5-29f0-4265-9602-d434bc1948ec/how_to_start_a_weber_propane_grill.pdfIn PDF document text
    • http://gixufedexakav.atwebpages.com/biodata_sample_for_marriage.pdfIn PDF document text
    • https://s3.amazonaws.com/risalenefazozo/60154371194.pdfIn PDF document text
    • https://80c8fd16-4cf8-4f9f-b52b-d6c956df8f3b.filesusr.com/ugd/1a94e8_3cc004407e7f4e4b9d47a7bab8e863f3.pdf?index=trueIn PDF document text
    • http://zuxokoberibaw.atwebpages.com/sorolinukasoxos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c28aba83-2aa5-4363-8783-1cbf1f99a8ad/70182429596.pdfIn PDF document text
    • https://37e0f79d-b0c1-4727-b76d-5b759c81288f.filesusr.com/ugd/9c66ff_d1494f991ac54539a1954b049b85b217.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/052f88e0-0397-4561-a2e9-2abc8f63c09b/samsung_galaxy_note_3_battery_capacity.pdfIn PDF document text
    • https://s3.amazonaws.com/dewutexorob/mendota_fireplace_insert_efficiency.pdfIn PDF document text
    • https://s3.amazonaws.com/magapeguwabe/deled_2018_marksheet_semester_2.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101EA 5552 bytes
SHA-256: e9fe7e04fedc15fb02e33c4d58207e3c552e09634d4545798eba6542d35536bb
font_01_sfnt_off00011502.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11502 12168 bytes
SHA-256: 273221794e317af0ac147c870ead4cc5b223d703bce25f16369ff633296885db

Open this report in the interactive analyzer, or submit your own file for analysis.