Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6553a047afb04e9…

MALICIOUS

PDF

78.3 KB Created: 2021-03-05 07:40:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 060750683e6c3b9d14caf2df4adf9a1a SHA-1: bb4c68dff472b35fc99dfb4389944f9b37cb4b00 SHA-256: c6553a047afb04e921c45c4f21a38a96e4d5bd39ece9f4047c7127a2f5ead57b
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The presence of a 'download button' heuristic further supports the lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=hocus+pocus+full+movie+free+download
    • https://cdn.sqhk.co/gosukutusu/ighfrhb/3495339300.pdf
    • https://cdn.sqhk.co/ponesigis/yjijgjc/steam_games_on_sale_for_free.pdf
    • https://bokoxopeke.weebly.com/uploads/1/3/4/2/134266118/vivor.pdf
    • https://gipebikurowa.weebly.com/uploads/1/3/4/0/134095939/bedovamas.pdf
    • https://cdn.sqhk.co/tamenotu/fgizyjd/81831488552.pdf
    • http://dimupure.22web.org/xukodevutijubejudagofogi.pdf
    • https://cdn.sqhk.co/vapatibu/eih3Whf/247_blinds_discount_code_december_2019.pdf
    • http://xemizawufogutuf.scienceontheweb.net/nikisaxigewikarikosinive.pdf
    • https://digonowokeke.weebly.com/uploads/1/3/1/8/131856318/venopawa.pdf
    • https://fudegenajeno.weebly.com/uploads/1/3/4/5/134581691/metenopibububexawom.pdf
    • http://vumogegotawugub.mypressonline.com/rufenuj.pdf
    • http://pidawudimo.scienceontheweb.net/how_to_install_d_link_dir_655_router_firmware_update.pdf
    • https://cdn.sqhk.co/dojarodawiw/iNgfEYq/xupiloratifosokowedal.pdf
    • http://zonizubiro.getenjoyment.net/gegatisejegeragoku.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/40416980-812c-4c4a-9633-a889f82f65e7/my_hp_photosmart_7510_is_printing_blank_pages.pdf
    • http://betiravel.epizy.com/lujipabuvisap.pdf
    • https://s3.amazonaws.com/bawalidamovidud/5008145922.pdf
    • http://vebusatoro.atwebpages.com/project_management_software_microsoft_visio.pdf
    • https://uploads.strikinglycdn.com/files/951ba5cf-e1fc-485b-b46c-15d157dc69b6/2435947039.pdf
    • https://s3.amazonaws.com/pivetuzadujo/its_vs_it_s_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/cbebd49e-c4f9-4172-8c56-a7636043d36a/end_of_life_operating_systems.pdf
    • http://dojeranorered.epizy.com/44194344459.pdf
    • http://pumamolo.rf.gd/delavugutiwebapagurige.pdf
    • https://uploads.strikinglycdn.com/files/a4621cf7-5d9e-4182-ad43-d273ad6be371/concordancia_diccionario_strong_hebreo_espaol.pdf
    • http://nejokamofa.rf.gd/how_do_you_program_a_replacement_tv_remote.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f630.bin
f145b7c6438d3de053bf6c8f13ab28371222c43d3f817278d6cd8dc9ed8e8a6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF630 5412 bytes
font_01_sfnt_off0001089a.bin
1ef9eda26d11a91e2ce9133b54319481f5090e7be46935018f28111809775258		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1089A 10240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.