Malicious PDF — malware analysis report

Static analysis result for SHA-256 c35cd8749e5ed7c3…

MALICIOUS

PDF

78.4 KB Created: 2021-04-04 11:43:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6df781c04f22136fb4744baacfc3ac01 SHA-1: 5d566658c96cafcfbe2d01a681c12dd9b31f8b94 SHA-256: c35cd8749e5ed7c315fb3405adde3403251c9d3867ea43a2cbd8dfbbb894fb4a
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded external URLs and a heuristic firing for a 'download button' lure suggests the document is designed to trick users into downloading further malware. While no scripts were extracted, the PDF structure and embedded URLs point towards a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=chapter+14+work+power+and+machines+worksheet+answer+key
    • http://steelsho1.club/what_is_the_difference_between_left_handed_and_right_handed30xsb.pdf
    • https://cdn.sqhk.co/simumufij/eePpWGB/60439777748.pdf
    • https://cdn.sqhk.co/tekixonef/zjcicjf/33214341022.pdf
    • https://cdn-cms.f-static.net/uploads/4417327/normal_5fd7e7688c8dc.pdf
    • https://static.s123-cdn-static.com/uploads/4412761/normal_600011e019e69.pdf
    • http://copyrightsupporthelpcenter.com/gopotunomajisidubukofivovysvo.pdf
    • http://klossheff.xyz/games_android_2018_apk4sid9.pdf
    • https://cdn.sqhk.co/budajawisore/uUWCjiS/farowidosu.pdf
    • http://trastqort.online/mankiw_macroeconomics_5th_edition_solutionsrt3ld.pdf
    • http://sethel.xyz/raxor9mkj8.pdf
    • https://cdn-cms.f-static.net/uploads/4490757/normal_6056db0f2812b.pdf
    • https://cdn.sqhk.co/jipodipotaj/jhhjnjf/marketplace_nyc_customer_service.pdf
    • http://remont-pc.website/rot_rankle_synonymgt0f3.pdf
    • http://fruittea.space/16740543407r9qvx.pdf
    • https://static.s123-cdn-static.com/uploads/4369776/normal_5fcbb0487eb7d.pdf
    • http://bodyita.space/kumezinisivuzubujoj7tyz5.pdf
    • http://all-casino.xyz/anime_app_for_android_tv_boxf1ztl.pdf
    • https://cdn-cms.f-static.net/uploads/4460457/normal_6021cf297c2a8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_737174fec99e4e5d856de53cb6a62bfa.pdf?index=true
    • https://601bead5-a720-4f65-98db-62fe2a42cb91.filesusr.com/ugd/0e52b4_ca3bd0938c784f518ca0bccbe19f4e2d.pdf?index=true
    • https://86a9da1b-0b57-4b35-a77a-523886b904cd.filesusr.com/ugd/0d9a50_615e8aaf88d941a788c526fa493f8bab.pdf?index=true
    • https://4c982f7a-b72b-446d-8c7a-5e2d6818c0db.filesusr.com/ugd/519a61_96d9feffa01d4a3fb0b28070478c2d14.pdf?index=true
    • https://2e4d99de-9d37-4ce2-abd5-0bbccafdbe51.filesusr.com/ugd/33a2e4_32b8bd2f50d54acf883e593d77e1ed06.pdf?index=true
    • https://4e33067b-0f13-4bed-bb9c-ea95f768fd7c.filesusr.com/ugd/23924c_47ff361b45224b55b7a5238653dd539a.pdf?index=true
    • https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_6e43fa02719745e59eae3889a9220238.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f20a.bin
8f9f7e9bd375c19728607249196034feae630771119bb2d3a00a4a4aaf442580		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF20A 5584 bytes
font_01_sfnt_off000104f9.bin
64948a386ee98ececda54f7c376cf0e25c3b83237a40c955a12460e97977e303		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104F9 11448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.