Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb40b15cc23b5c68…

MALICIOUS

PDF

77.2 KB Created: 2021-06-01 00:36:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c455db474e78ce3ffb3b0388b6c99bd5 SHA-1: ee76f4300f032c19b971aea1956b587d26e41001 SHA-256: cb40b15cc23b5c6875a6d998d46f125b3e78873cabceb178baeb4438501f532b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and is flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The embedded URL, 'https://crewmak.ru/pbw?utm_term=hard+reset+iphone+6', is presented in a context suggesting a lure for a scam or phishing attempt. No scripts were extracted, but the presence of a malicious URL within a PDF document strongly suggests an attempt to redirect the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=hard+reset+iphone+6
    • https://cdn-cms.f-static.net/uploads/4375075/normal_60183ead3dc05.pdf
    • https://cdn-cms.f-static.net/uploads/4418574/normal_6028f3f7e6d5d.pdf
    • https://cdn-cms.f-static.net/uploads/4446921/normal_601174284218f.pdf
    • https://cdn-cms.f-static.net/uploads/4462038/normal_6035aa7849f65.pdf
    • https://static.s123-cdn-static.com/uploads/4374847/normal_5fdd4ac9ade51.pdf
    • https://cdn-cms.f-static.net/uploads/4366311/normal_6014b661dc1f1.pdf
    • https://static.s123-cdn-static.com/uploads/4379486/normal_5ffa27acabb95.pdf
    • https://cdn-cms.f-static.net/uploads/4388428/normal_606e57212b7ec.pdf
    • https://static.s123-cdn-static.com/uploads/4410989/normal_6002658669e04.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://niwomif.pbworks.com/f/salary_after_11th_bipartite_settlement_quora.pdf
    • http://vowujepojez.pbworks.com/w/file/fetch/144428733/wujebep.pdf
    • http://xuruzinijub.pbworks.com/f/vuvinu.pdf
    • http://lekipirunezi.pbworks.com/f/ipcc_standards_on_auditing_short_notes.pdf
    • http://viluxese.pbworks.com/w/file/fetch/144428652/seriwafoxagoxi.pdf
    • http://jesababa.pbworks.com/f/8452973521.pdf
    • http://niwomif.pbworks.com/w/file/fetch/144428781/why_does_my_dog_look_at_nothing.pdf
    • http://niwomif.pbworks.com/w/file/fetch/144428112/12768779876.pdf
    • http://xedidovetaw.pbworks.com/w/file/fetch/144412518/54740183798.pdf
    • http://tazijebep.pbworks.com/w/file/fetch/144428571/16154809140.pdf
    • http://tazijebep.pbworks.com/w/file/fetch/144428865/1v1_lol_unblocked_games_77_ez.pdf
    • http://kokoxudalux.pbworks.com/f/bollywood_actress_without_makeup_photos_images.pdf
    • http://rugewenuzed.pbworks.com/w/file/fetch/144421809/mebozininadinu.pdf
    • http://niwomif.pbworks.com/w/file/fetch/144428337/multiplying_and_dividing_rational_expressions_worksheet_doc.pdf
    • http://bekivuxuga.pbworks.com/f/evaluating_numerical_expressions_with_exponents_worksheets_answers.pdf
    • http://bupataved.pbworks.com/f/1776_musical_libretto.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f162.bin
be76f98dc423e90eef7aba808e9137037ea057e6c07e493c94553c4d259dcf05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF162 5128 bytes
font_01_sfnt_off000102cb.bin
1d95bfc43d2b9f259f1bae179dff9d31af89d5504032a19c9a74d410b4e3837d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102CB 10840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.