Malicious PDF — malware analysis report

Static analysis result for SHA-256 c511de2233c523d4…

MALICIOUS

PDF

83.6 KB Created: 2021-04-25 08:35:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9e71358323f896ce05483869d8812e94 SHA-1: 6e595459762eab1cf0842e06daac34a4c9535b59 SHA-256: c511de2233c523d40aec9ffb4a7e261792ab0b1cde87a695a492eb67e92082c2
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is flagged as malicious. The 'SE_INVOICE_LURE' heuristic suggests the document's content is designed to trick the user into clicking the link, likely for phishing or malware delivery. No scripts were extracted, but the presence of a malicious URL and the invoice lure strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=what+are+the+three+main+types+of+business+activity
    • http://hermidkovo.info/how_to_use_the_tub_clean_cycle_on_an_lg_washert6oan.pdf
    • http://netewe5.xyz/today_s_weather_forecast_for_chicagookxom.pdf
    • http://wolifote.getenjoyment.net/22105470835.pdf
    • http://coolvdomaion.online/simple_present_verb_to_be_exercises_agenda_web2ec7h.pdf
    • http://kimujedat.mygamesonline.org/71223067512.pdf
    • http://sivolejujivozul.scienceontheweb.net/capital_expenditure_and_revenue_expenditure.pdf
    • http://tanemazijafawin.medianewsonline.com/95395004194.pdf
    • http://6gusevshop.space/chakram_jagamanta_kutumbam2lzd6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/mexijegedakol/43252863837.pdf
    • https://s3.amazonaws.com/kuboki/ketafesojubaxarodebut.pdf
    • https://uploads.strikinglycdn.com/files/33eb537b-3fbf-4701-85c1-0b7ad35a369e/8558020275.pdf
    • https://s3.amazonaws.com/waxegatulo/bootstrap_tutorials.pdf
    • https://uploads.strikinglycdn.com/files/ecd0321c-6271-4074-bea4-a1e4fdde6022/how_do_you_reset_a_nuvision_tablet.pdf
    • https://s3.amazonaws.com/sixolose/dubelivumozel.pdf
    • https://uploads.strikinglycdn.com/files/15879e41-65d6-4f9b-9143-f9533e04c8dc/warhammer_40k_tyranid_codex_download.pdf
    • https://s3.amazonaws.com/wexukufedepim/bengal_tiger_telugu_movie_english_subtitles.pdf
    • https://s3.amazonaws.com/lepefi/ansible_a_file.pdf
    • https://s3.amazonaws.com/vipuxafol/nugetopepoku.pdf
    • https://uploads.strikinglycdn.com/files/3645efb9-e303-4e23-a8de-f64da610c138/laforutobuzafeki.pdf
    • https://s3.amazonaws.com/xabalaru/despite_and_although_exercises.pdf
    • https://s3.amazonaws.com/mubefula/acuerdo_de_basilea_1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc71.bin
bf3f776206ab27dbfe608a3b0d8e6eb26fd81e55c6fbf89226e7ffe2b419d88f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC71 5420 bytes
font_01_sfnt_off00010ecc.bin
d71dfa196b27e37ff8d4abea1b233d212ea3f8fc0801dca8c17b84e752bfef90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10ECC 10440 bytes
font_02_sfnt_off00013286.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13286 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.