Malicious PDF — malware analysis report

Static analysis result for SHA-256 c004a6ad3962f8a4…

MALICIOUS

PDF

79.9 KB Created: 2021-04-22 02:12:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a88f83d90ec43f7dc231bbcc5e6f860f SHA-1: dc84a1934a1ce2613c4cec9062d74172e8fddc96 SHA-256: c004a6ad3962f8a4fe67cba7146d275a9884ec16c27e1a41c76055f3a792b15e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document contains embedded URLs, one of which points to a suspicious domain, suggesting a phishing or credential harvesting attempt. No scripts were extracted, but the presence of embedded URLs and the high confidence malicious verdict point towards a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=python+list+append+time+complexity
    • http://gododerur.66ghz.com/como_hacer_manualidades_para_halloween_con_papel.pdf
    • https://cdn.sqhk.co/vefasebo/36ijiir/bafavuganagi.pdf
    • https://cdn.sqhk.co/pulovafafita/I0gdYhg/vatusilipewukuf.pdf
    • https://cdn.sqhk.co/neliwuwo/fiiCjeN/kuneg.pdf
    • https://cdn.sqhk.co/nowagenika/ghiahiz/26481575642.pdf
    • http://labiluwewinedu.22web.org/opera_browser_free_vpn.pdf
    • https://cdn.sqhk.co/tajudozizif/jV9E1Ad/39338689534.pdf
    • https://cdn.sqhk.co/demanajinu/fgcL9Mk/plants_vs_zombie_party_decorations.pdf
    • https://cdn.sqhk.co/suxavawudomo/ih64jgi/zosate.pdf
    • https://cdn.sqhk.co/rodofusavivi/4hiA1je/nobebudirologo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/14ab3534-1346-451e-b078-eff6f5b82089/62942521716.pdf
    • https://s3.amazonaws.com/naxozelozude/kojodogapimidedu.pdf
    • https://s3.amazonaws.com/zijivevip/taboxisug.pdf
    • https://uploads.strikinglycdn.com/files/3dafe80f-3b9e-49cb-a419-fdf2e69b3ea9/barron_essential_words_for_the_toefl_4th_edition.pdf
    • https://uploads.strikinglycdn.com/files/dd65f04d-941c-40bd-80d2-0a71812d2ce7/29061218565.pdf
    • https://s3.amazonaws.com/kovilowab/dungeon_master_s_guide_the_trove.pdf
    • https://uploads.strikinglycdn.com/files/c4b44240-04f6-4572-9414-16ee62db392f/jejodumekofubododitepi.pdf
    • https://s3.amazonaws.com/lakujusitejojet/iao_valley_weather_report.pdf
    • https://uploads.strikinglycdn.com/files/ee44b34a-3caa-47f7-a63c-ee83207e7bd3/nuxoxojix.pdf
    • https://s3.amazonaws.com/lerezazo/30564804873.pdf
    • https://uploads.strikinglycdn.com/files/4cc471f3-8f95-4d2d-b5a8-a40c5a3b8da2/does_dish_voice_remote_work_with_wireless_joey.pdf
    • https://uploads.strikinglycdn.com/files/10edbb6d-aa04-4043-a067-fec8f363cb41/panasonic_genius_prestige_microwave.pdf
    • https://uploads.strikinglycdn.com/files/b323dd67-780a-4e6b-9268-866656cc4c18/naxugiwinonikalivaz.pdf
    • http://pitefabe.epizy.com/us_history_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f800.bin
0558894a9dc4a3c1604a3167af07f5f47850214775a98d8c6c7eacc068e8be28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF800 5388 bytes
font_01_sfnt_off00010a42.bin
adfa1f4ae3281805690562f81d10bb7b966004ebc0bbe1f93551429c15aa65dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A42 11224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.