Malicious PDF — malware analysis report

Static analysis result for SHA-256 c710dae2bbc1c746…

MALICIOUS

PDF

1.91 MB Created: 2022-05-28 01:32:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2022-07-15
MD5: df4ac71e31608623d8e06999f09842f0 SHA-1: 7380fc0d2eb60cba965e05f49f8f328a4cc99a53 SHA-256: c710dae2bbc1c746123c9e66f74244892e6db98b400b76bb8d58605247176997
86 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The critical ClamAV detection and the SE_CALLBACK_LURE heuristic indicate a phishing attempt. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create malicious PDFs. Numerous embedded URLs were extracted, likely serving as lures or download locations for further payloads.

Machine Learning

  • Nyx PDF Classifier clean score 0.0054

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ragaz.co.za/XSRYdR1H?utm_term=pw+atkins+physical+chemistry+pdf++pdf+file
    • https://sportuna.be/ckfinder/userfiles/files/36289681973.pdf
    • https://aildf.in/userfiles/file/72955694763.pdf
    • http://mmkotomasyon.net/userfiles/file/71478454463.pdf
    • http://cathyknightwaite.com/ckfinder/userfiles/files/88527242186.pdf
    • http://lavalnerina.com/userfiles/file/masinoguruzuro.pdf
    • https://webrekruit.com/php_codes/Scott/VieauAssociates/code/userfiles/file/15557207474.pdf
    • https://binarbaidservices.com/public_html/userfiles/file/mowesag.pdf
    • http://www.zulfugar.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16228c1998a1c9---90392169282.pdf
    • http://cozyboutiquecruise.com/upload/fck/file/kezobilarikigup.pdf
    • http://westernvintage.com/kcfinder/upload/files/bamonusetivogavogavobe.pdf
    • http://kd-council.com/upfile/files/65232886293.pdf
    • http://vp-concept.ch/app/webroot/kcfinder/upload/files/majunukitemefalijuta.pdf
    • https://styliststudios.com/imagesTE/file/19658895439.pdf
    • https://www.energetisch-therapeut-estie.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1626e7548f227a---5710451412.pdf
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/837a63a5dcd711516fe7608117f21819/62360564067.pdf
    • https://fontini-rozetki.su/kcfinder/upload/files/1032742144.pdf
    • http://kppzp.pl/userfiles/file/dikagexawewutivelil.pdf
    • https://www.crossfitparamaribo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16250f3e32be31---povavebimi.pdf
    • http://rococosofa.com/files/files/fowimuriwunoxepavoxobo.pdf
    • https://elearning-chemistry.remetea.ro/userfiles/file/72346020825.pdf
    • http://yejiya.com/userfiles/file/88853469398.pdf
    • http://ecolservizinettuno.com/userfiles/files/55240955019.pdf
    • https://die-elke.de/cms/elke_page_files/file/keluvakudi.pdf
    • https://emotionalgift.youngzonejewelry.com/ckfinder/userfiles/files/rotizu.pdf
    • http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/162570a847bc98---gumuvavikokuwemeni.pdf
    • http://mamnonsaokhue.vn/app/webroot/files/ckfinder/files/vasekajabasefezesinak.pdf
    • https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/1625277ed2421a---sebesageruv.pdf
    • http://masters.unige.ch/kcfinder/upload/files/26385747961.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off001deac8.bin
27bfb3378d2a47d73096f68284aedd1e4e6b67c46c6c366d4a4914e7d662fe4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DEAC8 11060 bytes
font_01_sfnt_off001e046e.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E046E 16792 bytes
font_02_sfnt_off001e1c8c.bin
9b0c8fb302d2409f34563c1f780c3c9660e80e51682cdc6ab2df0e91ea08f0ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E1C8C 30660 bytes
font_03_sfnt_off001e6fa4.bin
8a60cf833cce4e3fdaf65e1533aa6a7f97965bef742464fdf9f687d529275d39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E6FA4 7680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.