Malicious PDF — malware analysis report

Static analysis result for SHA-256 c436b9bc4b05c44e…

MALICIOUS

PDF

71.6 KB Created: 2021-02-13 10:24:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: f7918de22459398b0e000f9a59c376ab SHA-1: b08835541bef99c58176f5760dff698f9af993de SHA-256: c436b9bc4b05c44e9bac7ccbc6bdd7fd13805d6d052ee367df8dcfcb47f014b2
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL points to a site offering 'Arcsoft totalmedia 3.5 software free', suggesting a lure for users seeking software. The presence of external URIs and the 'Download Button' heuristic further support a phishing or scam attack pattern. No scripts were extracted, but the overall context points to a malicious document designed to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wb?keyword=arcsoft%20totalmedia%203.%205%20software%20free PDF link annotation
    • https://cdn.sqhk.co/wepurodapike/JDAcojf/housecall_providers_of_oklahoma.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387806/normal_5fcbd493349e4.pdfIn PDF document text
    • http://wogaxuma.22web.org/gd_t_bonus_tolerance.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376380/normal_5fe826d2e602e.pdfIn PDF document text
    • https://cdn.sqhk.co/gedodupem/jeh1ihW/19595686561.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465397/normal_5fe78680c8c99.pdfIn PDF document text
    • http://wuzotevoxed.22web.org/anglo_norwegian_fisheries_case.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446499/normal_600cf2a10a194.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vososasoxumete/pizejopole.pdfIn PDF document text
    • https://s3.amazonaws.com/farowug/40935009783.pdfIn PDF document text
    • http://mefinuxewo.epizy.com/android_emulator_for_chrome_browser.pdfIn PDF document text
    • http://mobopufo.rf.gd/b._h._m._s_full_form.pdfIn PDF document text
    • https://s3.amazonaws.com/fopalew/autocad_3d_animation_software_free.pdfIn PDF document text
    • https://s3.amazonaws.com/ratixifo/somotuzenodafebiris.pdfIn PDF document text
    • https://s3.amazonaws.com/murudute/concept_of_self_awareness.pdfIn PDF document text
    • https://s3.amazonaws.com/satulibaren/werunefegogeforelivudoju.pdfIn PDF document text
    • https://s3.amazonaws.com/wezukep/happier_piano_sheet_music_easy_with_letters.pdfIn PDF document text
    • http://kovodolalaloru.rf.gd/84289606967.pdfIn PDF document text
    • http://zarenubopopo.epizy.com/new_company_introduction_mail_format.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7E0 5568 bytes
SHA-256: e173921995b2d57dc4d1353e53fce7d2c1482ef69cb663ded3880a70ddb7f866
font_01_sfnt_off0000ead0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAD0 12216 bytes
SHA-256: ae2e9e1980ae0a29659dbc56865f5dc09d5f1cd567322b301c1caa42bb575bd2

Open this report in the interactive analyzer, or submit your own file for analysis.