Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5184d78752734e7…

MALICIOUS

PDF

84.2 KB Created: 2021-03-27 23:05:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5a8ef96d382ee1dd5968cff6d44469dc SHA-1: 6e82aea8bc77e492a1bfb0a0334c61a986e492b6 SHA-256: b5184d78752734e77a400a3ba76c09ea4e5b69063e2c4935e98e04029e75f9ea
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that, when clicked, likely leads to the download of a malicious payload. The document body, though partially corrupted, suggests a lure related to a 'calendar template'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=calendar+template+goodnotes
    • https://cdn.sqhk.co/gotakavapu/gElyijO/siwanaxa.pdf
    • https://cdn.sqhk.co/vilosezuj/iejbbij/6306241701.pdf
    • https://static.s123-cdn-static.com/uploads/4488855/normal_6008953240b6b.pdf
    • https://cdn-cms.f-static.net/uploads/4417141/normal_6011fb913baf0.pdf
    • https://cdn-cms.f-static.net/uploads/4379842/normal_60170bffb53d8.pdf
    • https://cdn.sqhk.co/feripamapuv/kZEnjjq/agent_orange_exposure_map_thailand.pdf
    • https://cdn.sqhk.co/pemenodisoda/jaTgeif/charlie_brown_coldplay_song.pdf
    • https://cdn-cms.f-static.net/uploads/4373769/normal_603f3202f3507.pdf
    • https://cdn-cms.f-static.net/uploads/4379483/normal_60219a38eb0ee.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e1bd05e7-a2ed-43df-b5fc-9bc8ee0b1a84.filesusr.com/ugd/08acf3_7712258a894a45d0bbbd55e550285c39.pdf?index=true
    • https://1cf095b7-1d29-4152-b82c-7733cf7ba0c7.filesusr.com/ugd/c1de29_8ba2ad9a6fc64336815001a035f9626a.pdf?index=true
    • https://53ebb62d-ddaf-432f-8dc3-1f4746653467.filesusr.com/ugd/bbd3cf_9423df2807f04520a3f1c9f599d78894.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a98fb7e7-9ee2-4c72-8051-6893757eff91/twilight_part_3_movie_download_in_tamil_isaimini.pdf
    • https://s3.amazonaws.com/guwutivupudutu/sinejunodewijinefa.pdf
    • https://uploads.strikinglycdn.com/files/258669d1-43ef-4a09-baa4-5d5e0cc84774/how_to_reset_ge_gas_oven.pdf
    • https://170a7d3c-74f0-42f5-9ead-98ae292a4922.filesusr.com/ugd/a18aa6_ef4d4262894749deb18de8be6665301a.pdf?index=true
    • https://e02212b7-c8ec-4bf5-ba3e-d68a1de675e0.filesusr.com/ugd/7f1d73_aba4d10542164bbd82fa2f12c91caa01.pdf?index=true
    • https://s3.amazonaws.com/jeworurowam/identifying_phases_of_the_moon_iv_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/74c1d269-465c-4be4-a4a4-942b3335a766/how_many_gold_bricks_in_lego_harry_potter_5-7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b6f.bin
bb2be451aa955578e27b559695e7c5263f4a19130151f82f19135c0292e9a00e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B6F 5184 bytes
font_01_sfnt_off00011cf1.bin
a02d634444ba798278a485aaf70ef148ae40016d9e93f4c5ffeb4fc356980f77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CF1 11468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.