Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8ca6fb481e11437…

MALICIOUS

PDF

83.0 KB Created: 2021-03-23 17:34:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 33a76437386e22702a76046da08953b6 SHA-1: 40f87b111b6c8516d6582c0b39e105b111c0895d SHA-256: b8ca6fb481e114370ea8a34acc32f56fe4ccf19d257c445c211b0246ccf06b1a
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that, when clicked, likely leads to the download of a malicious payload. The document body, though heavily obfuscated, contains text related to downloading robotics engineering books, serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=robotics+engineering+books+pdf+download
    • https://cdn.sqhk.co/kimefutif/6hf25Z6/mind_games_during_pregnancy.pdf
    • https://cdn.sqhk.co/pikikunifav/cIhdC8Q/58552115748.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/9713c755-7638-402e-b289-ee21c77b2a90/92848156090.pdf
    • https://s3.amazonaws.com/bulozor/xukexajufitevatu.pdf
    • https://uploads.strikinglycdn.com/files/783665a7-b53e-4a18-acc1-48611e5c3ebd/2004_chrysler_pacifica_battery_drain.pdf
    • https://uploads.strikinglycdn.com/files/6658bae1-30de-4845-9590-34d3f1d52076/52282813885.pdf
    • https://uploads.strikinglycdn.com/files/66940e74-5702-4ffe-8ba7-f92749b6a0b9/calibrate_samsung_uhd_tv_6_series.pdf
    • https://uploads.strikinglycdn.com/files/7f2a0cba-ecea-470a-8020-c480f414ac10/does_misa_die_at_the_end_of_death_note.pdf
    • https://uploads.strikinglycdn.com/files/9faa94af-2f04-4d55-9990-b8c93177bd20/8552910232.pdf
    • https://uploads.strikinglycdn.com/files/43d3e1a0-d2b1-45ed-9ea9-9638b7dba02b/huck_finn_jim_quotes_about_freedom.pdf
    • https://s3.amazonaws.com/bezutu/you_can_negotiate_anything_book_free_download.pdf
    • https://uploads.strikinglycdn.com/files/3bb66a04-1e25-49bd-9d26-38ac21e0599e/faxaledupaguresulel.pdf
    • https://s3.amazonaws.com/labitajaxatufib/believer_flute_sheet_music_imagine_dragons.pdf
    • https://uploads.strikinglycdn.com/files/f4984bd9-5532-4491-9d6b-e0b994bb1695/is_the_southern_reach_trilogy_worth_reading.pdf
    • https://uploads.strikinglycdn.com/files/ca4a3f3f-5601-44dd-941d-be909c0ac821/92369314017.pdf
    • https://uploads.strikinglycdn.com/files/e1c4388d-317e-48a1-b151-4e7bc764f7e5/30700316688.pdf
    • https://uploads.strikinglycdn.com/files/e18549d2-6a36-42d9-b95d-24ffd8a059c8/19707141039.pdf
    • https://uploads.strikinglycdn.com/files/2d85eb27-2390-4776-962f-a1c75b059044/business_analytics_internship_summer_2021.pdf
    • https://s3.amazonaws.com/gixawetopoli/consumer_reports_10_best_cars_2019.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3ed.bin
47d85983a90ee93554fdccaf896225807306446fd7546d36efc7e7884948a908
pdf-font-stream PDF embedded font (sfnt) at offset 0xF3ED 5628 bytes
font_01_sfnt_off00010731.bin
706c38f07fcb73ac2f9401dac3c736feb4d297f43a53b275038c2cf8cbaa258d
pdf-font-stream PDF embedded font (sfnt) at offset 0x10731 4452 bytes
font_02_sfnt_off00011791.bin
29e70f5e51d088d835c4243c062333c53aebb621246833184f1c724d9136ef85
pdf-font-stream PDF embedded font (sfnt) at offset 0x11791 10884 bytes