Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbecc78d359529f2…

MALICIOUS

PDF

105.3 KB Created: 2021-03-19 11:03:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9940ad14ebf5e7cd0c162b6ade68e9d9 SHA-1: 8a6278378f2dd550d0e57d3ac32d345c1bb14ca1 SHA-256: cbecc78d359529f2dcb73fa84832d00eb55162c508f56678a4e3f4169ea6d81d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search result for a technical manual, likely intended to trick the user into downloading further malicious content. No scripts were extracted, but the presence of the malicious URL and the high confidence verdict suggest a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=honeywell+prowatch+installation+manual
    • https://cdn.sqhk.co/zekafomaze/tihggx9/target_promo_code_electronics.pdf
    • https://cdn.sqhk.co/sepovili/cZAxibk/nupilodotorifov.pdf
    • http://fujubipe.22web.org/fewokevipof.pdf
    • https://cdn.sqhk.co/tajudozizif/ifjai3m/vekapize.pdf
    • http://mijogunabisojil.iblogger.org/19622127944.pdf
    • http://lnstagramverifiedbadge-form.com/diary_of_perpetua5fvs9.pdf
    • https://cdn.sqhk.co/vafegijateno/ijhzjfq/18864346373.pdf
    • http://1xbets-regs.site/40358421689he5wr.pdf
    • https://cdn.sqhk.co/feluxolid/je1hb8K/44530331144.pdf
    • https://cdn.sqhk.co/vedanoderifu/jb76ghf/motadukomevupegesevuxowu.pdf
    • https://cdn.sqhk.co/diwelamu/cdAnhgd/29423824468.pdf
    • http://helpcontactform.com/hardcoded_game_guidenph53.pdf
    • http://acupofjacob.com/130503920043ulbn.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/fukezavazuj/92490150560.pdf
    • http://ruxogofirovudux.epizy.com/jitiwadesumidaxuxobokut.pdf
    • http://mukesijurifa.epizy.com/how_to_rekey_a_schlage_commercial_lock.pdf
    • https://s3.amazonaws.com/mujesogi/shark_fabric_steamer.pdf
    • http://fezigaf.epizy.com/conair_clothes_steamer_not_working.pdf
    • https://s3.amazonaws.com/tokit/9613461178.pdf
    • http://getuvodiv.epizy.com/how_to_connect_to_oontz_speaker.pdf
    • http://fomupobidep.epizy.com/complete_autocad_tutorial_free_download.pdf
    • https://s3.amazonaws.com/nagev/85663734177.pdf
    • http://dezezefisimel.rf.gd/rofavusemajek.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000152db.bin
8f2de12af509e5d5434edbc4d44f9957ce54f1c45195de3c507e15d6da7232c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x152DB 5208 bytes
font_01_sfnt_off00016472.bin
5d4cada654827a32f01934a58cacc2cd2f3a6dbdb4521d2dfcbe7d2a85366d05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16472 10764 bytes
font_02_sfnt_off00018952.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18952 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.