Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2b3c98053de879d…

MALICIOUS

PDF

78.9 KB Created: 2021-04-06 12:36:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d78156c0ee7f17ed7fec3da5e3ec6f1 SHA-1: 2997d5eaf3131392dd4156e2c9f648c21ba066be SHA-256: c2b3c98053de879dccfb0ba370069beee9790c277d25f3633ff5d99f7caeccce
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL and the text within the document body suggest a phishing or scam attempt, directing the user to a suspicious domain. No scripts were extracted, but the presence of external URIs and the overall detection score strongly point towards a malicious PDF designed to lead users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=android+studio+ndk_debug%253D+1
    • http://moreprodukti.com/lakshmi_ashtothram_telugu9cry8.pdf
    • http://a-trvl.ru/33804902728bn8bl.pdf
    • http://tinubawolu.mywebcommunity.org/the_bourne_legacy_book_free_download.pdf
    • http://datab.vip/93870223451d35yy.pdf
    • http://feremujidonigu.getenjoyment.net/autonics_catalogo.pdf
    • http://gonifarej.mywebcommunity.org/13144979872.pdf
    • http://xogakijukutikep.22web.org/vocabulary_for_ielts_anneli_williams.pdf
    • http://zuduwamani.mypressonline.com/nevowugegorobenetaneg.pdf
    • http://mugedly.xyz/emulator_ps2_pcsx2_android7acvo.pdf
    • http://xadexawufomovi.sportsontheweb.net/calendario_2020_argentina_descargar.pdf
    • http://halfraire.xyz/vesewunuraderiditenupoxly8dc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://63150c49-9e7f-4923-bc7a-1e4049050ce6.filesusr.com/ugd/cba449_b20a9bb126b44c66a5e224f7bc39b8bf.pdf?index=true
    • https://s3.amazonaws.com/davolazupivowi/fifoserelarefinulolejal.pdf
    • https://6dca1d0c-b102-4aa4-a312-d013f97c39dd.filesusr.com/ugd/fb87fb_d8d94cbee4a14ca4be830728c52b5f58.pdf?index=true
    • https://e0271a52-a7af-48e9-8a99-924ce320ec62.filesusr.com/ugd/be5703_d6109be984b44010b54be3e780853bd3.pdf?index=true
    • https://0306adf0-382e-42f1-903d-71c3961c97f1.filesusr.com/ugd/7ff653_dfc782437d544a01be0eac0e3c44a7fb.pdf?index=true
    • https://s3.amazonaws.com/tigewibejageju/53410289776.pdf
    • https://s3.amazonaws.com/lupebesu/acids_bases_and_salts_mcqs.pdf
    • http://gurevetafajes.epizy.com/fisukimugutuzobadokubos.pdf
    • http://duvodix.myartsonline.com/bostitch_floor_nailer_model_m111_manual.pdf
    • http://zurekenalemone.rf.gd/1157547288.pdf
    • https://168d2a81-f750-40c6-a653-3787650f980d.filesusr.com/ugd/3bcfef_08008d5f2df3471fa6541d1f1e3482fd.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8a9.bin
accd78f2d1a04d2ef24081661128fa99611a657b0a9715a50730c8a868d70136		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8A9 5072 bytes
font_01_sfnt_off00010a13.bin
ec3a1998c15d83a7c8cf75805b8869aba2c9464b776ff4d2e88676745063c4b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A13 10972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.