Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3316db20ff6a2fe…

MALICIOUS

PDF

72.9 KB Created: 2021-06-01 06:23:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: a2f70de989e9b76a6da74e7b348b42ba SHA-1: cdb506e38d4d92b5d5deb60a7d35fc788e8bc355 SHA-256: b3316db20ff6a2fe05d87d6930db201e392c705fc9dc10c9d9e0028ea0197a90
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The presence of an external URI pointing to 'oniceh.ru' and a heuristic indicating a visual download button suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, indicating it was likely generated programmatically to appear as a worksheet.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/pbw?utm_term=present+tense+verbs+esl+worksheet PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4389582/normal_5ff298e763a48.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488316/normal_601709b233fb9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475577/normal_6058ef7e64058.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469847/normal_6036891253f5d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369165/normal_603dc3cd29ab9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383136/normal_603b26ba44aa7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486351/normal_60525daa11730.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378857/normal_5fdbb77b7ed3e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0655d98b-b475-4f97-bad7-5c2ed4cf4474/disney_movie_safety_ray_mcelrathbey.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67e77923-a427-4611-b8d6-5ff906488d15/educational_psychology_pay_scale_uk.pdfIn PDF document text
    • http://zajozote.pbworks.com/f/lokab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1a86d3e-593b-4545-a65f-470bdbdce5d4/maximus_viii_hero_memory_compatibility.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f3d694f1-e59f-41a4-a748-9e909e230829/us_attorneys_office_philadelphia_internship.pdfIn PDF document text
    • http://lijegazoz.pbworks.com/w/file/fetch/144414294/vuxiwovadugugoteferu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fce9c7d-3e72-4490-a7b9-fb984ca1100f/white_fang_movie_2018_summary.pdfIn PDF document text
    • http://tazijebep.pbworks.com/w/file/fetch/144428148/how_to_develop_listening_skills_in_students.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6712cdeb-1edd-4f4c-88e7-e22721fc8baa/zogomopuvojafofagoronu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/606aceef-2e10-41b8-a6f7-8770de2b2fad/lemotopad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dbf7aa88-b626-4dfd-9183-efc77f79eeda/18951124753.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b9b587f-cbab-4837-be6e-97a54e52201e/56841882303.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d67fd5d-e266-4a40-a8a9-729eb170ed53/basic_spanish_vocabulary_lists_by_topic.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e110.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE110 4920 bytes
SHA-256: fde4e9d3acb6e71defedb8953bbe5e8ab2e08389a203b7c47b6ff3774ea55b52
font_01_sfnt_off0000f1da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1DA 10640 bytes
SHA-256: 74e3667f36c2aae0dc66bf45caff3c60af1a7f66f9ec894821c4bbcf0bb90f3f

Open this report in the interactive analyzer, or submit your own file for analysis.