Malicious PDF — malware analysis report

Static analysis result for SHA-256 c65d189973666099…

MALICIOUS

PDF

87.0 KB Created: 2021-05-19 23:06:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc33ba5846da0c69ffee67bd1a932a0e SHA-1: 9b8a4165455a00b9ef61fbfd5db353f3d48344b0 SHA-256: c65d189973666099751cd5fd54f439906d6e64efb9f568f50776a083c424a50b
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1204.002 Malicious Link

The PDF document contains heuristics indicating it is a callback phishing lure, specifically mentioning a 'bank balance checkbook worksheet' in its metadata and embedded URL. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URL points to a domain associated with phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=bank+of+america+balance+checkbook+worksheet
    • https://cdn-cms.f-static.net/uploads/4415292/normal_6010d8626c52e.pdf
    • https://static.s123-cdn-static.com/uploads/4427799/normal_5ff1c604b4481.pdf
    • https://static.s123-cdn-static.com/uploads/4486354/normal_5ff9be8b81356.pdf
    • https://static.s123-cdn-static.com/uploads/4455681/normal_5fcf7ef86bf28.pdf
    • https://cdn-cms.f-static.net/uploads/4378853/normal_60427f87157ae.pdf
    • https://static.s123-cdn-static.com/uploads/4421970/normal_5ffed1ecd6158.pdf
    • https://static.s123-cdn-static.com/uploads/4421639/normal_5fee879fa54a4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b8f29ca5-c7d9-48ba-b453-ea7c32442a77/67044604520.pdf
    • https://uploads.strikinglycdn.com/files/13f72d36-1449-4883-8de9-cdff0495658e/tawanavomamafilune.pdf
    • https://uploads.strikinglycdn.com/files/945ecdd7-23ff-4b13-b88e-f05abd2ebf39/five_proofs_of_the_existence_of_god.pdf
    • https://s3.amazonaws.com/pafexegud/what_is_a_synonym_for_progressive_elaboration.pdf
    • https://uploads.strikinglycdn.com/files/3b95288e-484f-407e-9e24-68acd3d3d4c7/11234698793.pdf
    • https://s3.amazonaws.com/farowug/saxeze.pdf
    • https://uploads.strikinglycdn.com/files/a48b2331-8e0f-4386-b1f7-c5488d287370/how_to_adjust_draw_length_on_bear_brave.pdf
    • https://s3.amazonaws.com/nilititonawafim/almandin_horse_form.pdf
    • https://uploads.strikinglycdn.com/files/cc5ca729-176b-412f-860a-32fabbe47382/zakololu.pdf
    • https://uploads.strikinglycdn.com/files/54de2173-021c-421c-9f1c-a3b1d38a3715/how_to_connect_bluetooth_to_panasonic_phone.pdf
    • https://uploads.strikinglycdn.com/files/912c79c4-ec2e-4d1b-81fc-609e54766fd4/75634470529.pdf
    • https://uploads.strikinglycdn.com/files/3547f269-4c25-4013-a71c-d75a5eb2621e/98979875996.pdf
    • https://uploads.strikinglycdn.com/files/f92237fe-c7f8-4b6f-906c-644202a7d04e/67914975059.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001142b.bin
54220d6678d264218a916638eb14877dcd32d8bde5a9736ed2ce7f94afac09b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1142B 5464 bytes
font_01_sfnt_off000126b3.bin
c9a4ad25866bc5000d5534864ab103a6f5f961ebaab10a33ac5dfa28be0aecd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126B3 11700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.