Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9c4a9a38d2c6df6…

MALICIOUS

PDF

147.4 KB Created: 2021-04-05 08:02:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f2cce2e2ddd7a11ad5410f26a60f8de SHA-1: dda9488d8b08b92ec43ce90f31188c2de6935185 SHA-256: b9c4a9a38d2c6df64b7a649432bf5f5947cc56fda5c1293f249260080a539002
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an external URI pointing to a suspicious domain, suggesting it's part of a phishing campaign. The presence of a 'download button' heuristic further supports the attack pattern of luring users to download a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=asian+art+history+pdf
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • http://businessoutsourcing.info/get_free_annual_credit_report_transunionx5mk5.pdf
    • https://walafikug.weebly.com/uploads/1/3/2/7/132740659/aef9326153.pdf
    • https://verikadofaja.weebly.com/uploads/1/3/2/3/132303102/8175379.pdf
    • http://vevaxogejaz.scienceontheweb.net/begums_thugs_and_white_mughals.pdf
    • http://pojokup.getenjoyment.net/donemuledatevidaza.pdf
    • http://presente-top.store/gotanekovipoparztz0.pdf
    • https://pimefukidipobe.weebly.com/uploads/1/3/4/0/134096137/02581.pdf
    • http://jozipuvuwuzaj.mywebcommunity.org/kafabafije.pdf
    • https://lulakoxefinadi.weebly.com/uploads/1/3/4/3/134332070/8883630.pdf
    • http://marinarus.space/voduxgfztb.pdf
    • http://vizemezezu.sportsontheweb.net/22621434946.pdf
    • http://mokemowowove.mygamesonline.org/behold_a_pale_horse_download.pdf
    • https://roxuxafuz.weebly.com/uploads/1/3/0/8/130813852/d176088eb7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/954a972c-f979-4623-ab57-4d439321897f/51549060115.pdf
    • https://s3.amazonaws.com/saziwijaxodav/46799394704.pdf
    • https://s3.amazonaws.com/papuja/facebook_cover_page_template_illustrator.pdf
    • https://uploads.strikinglycdn.com/files/a123c015-a6d0-4472-b586-9f3030de51fe/how_to_use_colored_pencils_as_eyeliner.pdf
    • https://61069a5e-3c5f-4884-a3c7-8c7552058b74.filesusr.com/ugd/0789d5_a4487bc671c64ae5b75f442a7ed46fbb.pdf?index=true
    • https://b42dfab6-8227-42c4-8fe5-fc04d9433513.filesusr.com/ugd/a9a8df_01fcb2418683446b8226a255f9c9a148.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e51c20c1-de21-45a2-8035-9f09e39b0400/74178076859.pdf
    • https://ce099f17-eb12-430b-a452-8d789b3ee5a8.filesusr.com/ugd/aef5b7_1cb0bf1ace754b869e1c106c596f0749.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1d9b85da-ca35-49a7-a55e-aecb340eaaca/36689948097.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001dc87.bin
b97f4eed935eac16b9dc9645240f66b6e5d0d94d497222a86b2b5531a072d6e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DC87 10496 bytes
font_01_sfnt_off0001ff4c.bin
a1c9124b72771f4bdf75839d7890dcea260c760f3a5836f54b4c53e44f4e5bc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FF4C 5188 bytes
font_02_sfnt_off000210f9.bin
13ecbe0585b37df0a8b475be04de193e182362f0c9f3a7f09575e996b132c164		 pdf-font-stream PDF embedded font (sfnt) at offset 0x210F9 15032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.