Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1597101a5dedb55…

MALICIOUS

PDF

122.5 KB Created: 2021-03-16 07:21:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 946779ddfab72771974c02cc36a41d8d SHA-1: eb21b65d49f113d1647175cafb0a5176383372ab SHA-256: c1597101a5dedb5528383f9c5c5185474b9bcac59e80b45f311313aeb4f37a13
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. The embedded URL points to a domain associated with malicious activity, likely serving as a lure for users to click and potentially download further payloads or submit credentials. Although no scripts were explicitly extracted, the PDF structure and heuristic firings suggest an attempt to exploit user interaction via a malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9472

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=abacus+how+to+use+pdf
    • https://static.s123-cdn-static.com/uploads/4369909/normal_5ff53f4ccfcba.pdf
    • http://xemokajoled.medianewsonline.com/buwakigolefuberiziveref.pdf
    • http://desajegurake.scienceontheweb.net/beps_action_plan_8_10.pdf
    • https://cdn.sqhk.co/kevamubeminu/ghwjijd/50081726310.pdf
    • http://wusozupu.mypressonline.com/buoyage_system_download.pdf
    • https://static.s123-cdn-static.com/uploads/4428331/normal_5fc89353dca48.pdf
    • https://cdn-cms.f-static.net/uploads/4386335/normal_5fe8bb03a1d36.pdf
    • http://dizititakozazi.mywebcommunity.org/30017348498.pdf
    • https://cdn.sqhk.co/potonefamuve/bjdTNx9/nopeveponupo.pdf
    • https://cdn.sqhk.co/muvotugi/ejgibM3/sukisuxijijorasiriguge.pdf
    • https://cdn.sqhk.co/negapevu/gijhgib/amazing_thief_synonym.pdf
    • http://fiwetud.scienceontheweb.net/80630654433.pdf
    • http://nawavidosuk.medianewsonline.com/23656756962.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vujijemu.atwebpages.com/38418845788.pdf
    • https://uploads.strikinglycdn.com/files/162d9131-60cf-4df1-bfe8-b3d44bf06291/zivudutakesupelutuma.pdf
    • https://uploads.strikinglycdn.com/files/66fe8008-a8bb-4986-a21b-74c0f0479d7f/12986013471.pdf
    • http://sanojepenot.onlinewebshop.net/32126419979.pdf
    • https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_ba3020b427034ae09741f842a403821d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0cc10721-afee-4fc8-b303-6667968c2166/62225893668.pdf
    • https://uploads.strikinglycdn.com/files/d3098236-da0c-4ac2-a4fb-38de5aab9cac/qu_es_una_ficha_bibliogrfica_de_un_libro.pdf
    • https://uploads.strikinglycdn.com/files/89866e95-fbfd-407d-8247-e66c06a855d0/simple_ukulele_chord_chart_printable.pdf
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_ef0e1274bbf64c369a5648551cfda358.pdf?index=true
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000177d5.bin
6adec6c845c6761edb3f1bb9e4357d5de32664db83d983335e2f6ea01bdb67d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x177D5 6004 bytes
font_01_sfnt_off00018ca7.bin
3e7bf25af0149db6ca152d4896f6c677dcad6b5b81eee3c8ca6bae8a01318ab8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18CA7 5336 bytes
font_02_sfnt_off00019ee2.bin
865a5660b29e287b245437da0740730f096d2837d8d0e50e6d03fc776976b95c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19EE2 18100 bytes
font_03_sfnt_off0001d4ca.bin
99ddc6f5858eb134f8024171ebe717cbd02485c31471b921a5021903b5272953		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D4CA 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.