Malicious PDF — malware analysis report

Static analysis result for SHA-256 c465d34ece2ff543…

MALICIOUS

PDF

81.9 KB Created: 2021-03-24 12:06:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 786a2b3c59ac9096cc9c027ebae28ac9 SHA-1: de0472b54345ac35e130e89d3b9fa82cb6b5cbc0 SHA-256: c465d34ece2ff543b27dba4f187068be8bca404c4c2f38eac8e216aaf14b25e5
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, and it contains embedded URLs that are likely used for phishing or malware distribution. The heuristic 'SE_DOWNLOAD_BUTTON' suggests a lure to trick the user into downloading content. The presence of embedded URLs and the nature of the detection indicate a phishing attempt disguised as a document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=cmc+entrance+exam+question+papers+pdf
    • http://gepatoxax.iblogger.org/xinupopa.pdf
    • https://cdn-cms.f-static.net/uploads/4464878/normal_6041d90cc1e69.pdf
    • https://static.s123-cdn-static.com/uploads/4369305/normal_5ff89b2fdf6d9.pdf
    • https://cdn-cms.f-static.net/uploads/4388038/normal_605002a78ee1f.pdf
    • https://static.s123-cdn-static.com/uploads/4466364/normal_6005f2bc7f1bc.pdf
    • http://xepuxupipe.mywebcommunity.org/9930145926.pdf
    • https://cdn-cms.f-static.net/uploads/4495042/normal_6020fcec9f675.pdf
    • https://cdn-cms.f-static.net/uploads/4426267/normal_6026046f62a88.pdf
    • https://static.s123-cdn-static.com/uploads/4500186/normal_5fde92c77a10f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://s3.amazonaws.com/gebukil/tokyo_guidelines_cholecystitis_2007.pdf
    • http://gudugapapilile.atwebpages.com/business_management_lecture_notes.pdf
    • http://vixadit.rf.gd/falling_slowly_sheet_music_free.pdf
    • https://s3.amazonaws.com/tiduro/16485534349.pdf
    • http://badamowafe.onlinewebshop.net/movie_genres_worksheet.pdf
    • http://goxafebo.myartsonline.com/principle_of_mathematical_induction_class_11_ncert_solutions.pdf
    • http://kenakazukigixow.rf.gd/autorunexterminator_free_for_windows_7.pdf
    • http://ridoretuj.rf.gd/pakikosogiburinem.pdf
    • http://mirajeramevex.rf.gd/xupowivifumifajurivajeb.pdf
    • http://pugagewuda.rf.gd/vilareloxa.pdf
    • http://lunofalogejutu.epizy.com/arrow_function_vs_function_performance.pdf
    • https://s3.amazonaws.com/firudegix/csi_new_york_season_13_episode_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f417.bin
fc62622fc07b2d5c2d4e1803a80a712fbf4fdc36ba0752f8b3ab4c898858dc32		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF417 5368 bytes
font_01_sfnt_off0001063c.bin
422f4b7b6aa6ac76e46aca08bedad32225fab6ba0a336258da8051cdca4f7a63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1063C 3968 bytes
font_02_sfnt_off0001144e.bin
22dcbe42ec516bcc0afb26ee17fd5b1b355f5861c85b3d4d8805d8c6e7da1800		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1144E 11060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.