Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdb5742e8a1b644c…

MALICIOUS

PDF

90.0 KB Created: 2021-03-17 09:59:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: d2b52d0b9d9693a8a517e4523c1b2032 SHA-1: 36842eeb5ec89ff9a5a5bcbd86574f507cf7871d SHA-256: cdb5742e8a1b644c30589f945c04b5e5481e400f1999bec0d0412cca06b9cf8e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URL pointing to a site offering a 'wic reset keygen download', indicating a phishing lure. The document body, though heavily obfuscated, contains keywords related to the URL, reinforcing the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=wic+reset+keygen+download PDF link annotation
    • http://qqkaxes.xyz/how_to_get_real_time_stock_pricesuffkp.pdfIn PDF document text
    • http://idealica-ufficialeitalia.website/duwajoselogepu1anpd.pdfIn PDF document text
    • http://grinallex.shop/the_prince_of_milkdotjr.pdfIn PDF document text
    • http://wacc-cat.org/47251731023qgl4h.pdfIn PDF document text
    • http://urott-hu.com/gunijurufewatamezfy059.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/fatikonavori/advanced_dungeons_and_dragons_players_handbook_2nd_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/wupuxus/bsc_mlt_syllabus_rguhs.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/cranial_nerves_names.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63e3e675-23dc-4816-8795-8bc88ed36fa6/903084801.pdfIn PDF document text
    • https://s3.amazonaws.com/vawoginele/candidiasis_oral_adalah.pdfIn PDF document text
    • https://s3.amazonaws.com/xonobijikivo/laptop_buying_guide_for_programming.pdfIn PDF document text
    • https://s3.amazonaws.com/rizoli/jesus_latin_meaning.pdfIn PDF document text
    • https://s3.amazonaws.com/gogoxowiniza/book_mockup_vector_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7ac74ad-f7c9-40fb-902a-da27d0992563/juluv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a08fa38-b757-4ffd-b592-31fb71988404/62939756078.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f979b26-13b6-4575-b8fd-05abcc41f838/earth_unaware_orson_scott_card.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/aila_aila_tamil_song_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e818e6fa-cb95-4836-99cc-fd8c2967283b/32489176241.pdfIn PDF document text
    • https://s3.amazonaws.com/fajeloninesitel/uncharted_the_lost_legacy_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/retobifulipo/exponential_decay_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/tirimofufemukat/82322714644.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A85 5168 bytes
SHA-256: f6c5adb768dcfdd044eb4e17f7dd335dc2e2c6781a17a097daaa46d77d722f3d
font_01_sfnt_off00011c3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C3D 20472 bytes
SHA-256: 44c25c60586b375019424b2725c02a173bec8bdab46a99405ab152e024ee747c
font_02_sfnt_off00014b10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B10 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.