Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce2ac5acf9cfd56f…

MALICIOUS

PDF

81.3 KB Created: 2021-03-31 11:21:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0adb612b58e5d595bc50051dfe8b1c9b SHA-1: 4230c9e667969f594df838251c04d4e5b92f6ebc SHA-256: ce2ac5acf9cfd56ff59c053bde55a2f4a9eecd71bb0addc5b012c7e9b5abc5c6
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains an embedded URL pointing to a suspicious domain, likely intended to deliver a secondary payload or lead the user to a phishing site. The presence of a 'download button' heuristic further supports a malicious intent to trick the user into downloading content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+do+crystal+growing+kits+work
    • https://cdn.sqhk.co/bimolixumotu/hfGibyn/fokaferod.pdf
    • https://cdn.sqhk.co/buruvalufe/cXBOjck/11853695116.pdf
    • https://cdn.sqhk.co/pevotido/gihtSHa/tesopodulajun.pdf
    • https://cdn.sqhk.co/sigidezok/Dhf6icU/world_war_z_game_ps4_controls.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/46570b8d-5353-40bb-b2fb-a640ae08e54b/zovofigoguvejabap.pdf
    • https://uploads.strikinglycdn.com/files/333a6a7a-6cd9-4280-8662-41a400d203f2/rerumelebusabo.pdf
    • https://uploads.strikinglycdn.com/files/a0526739-6154-48bf-b041-936207fa0fb0/30152713270.pdf
    • https://s3.amazonaws.com/fivebo/anti_spy_mobile_apk.pdf
    • https://s3.amazonaws.com/mixanaz/bihar_masti_video_song.pdf
    • https://s3.amazonaws.com/tawovojo/activex_control_in_vb.pdf
    • https://s3.amazonaws.com/wujixus/attack_on_titan_season_3_part_2_opening_name.pdf
    • https://uploads.strikinglycdn.com/files/4bca0e81-4565-4160-ba9c-cc25bd2e639c/mawutam.pdf
    • https://uploads.strikinglycdn.com/files/16ec9af1-d373-45c9-92d5-df80411c8aca/lemiruvim.pdf
    • https://s3.amazonaws.com/xonaxevetaf/edtpa_assessment_commentary_template.pdf
    • https://s3.amazonaws.com/ginutu/woody_allen_without_feathers.pdf
    • https://uploads.strikinglycdn.com/files/fa037b91-cf0c-477f-a0c4-8b605bb9706a/xomuguwebafem.pdf
    • https://s3.amazonaws.com/zinudipir/disgaea_1_complete_strategy_guide.pdf
    • https://uploads.strikinglycdn.com/files/723215b1-068e-49e4-9d74-1efa34cd55ad/vaborokikelit.pdf
    • https://s3.amazonaws.com/gekixadonuru/bissell_quicksteamer_powerbrush_pet_parts.pdf
    • https://uploads.strikinglycdn.com/files/1a107a13-9cd2-4412-97d5-cd7794109ade/boy_scouts_christmas_trees_near_me.pdf
    • https://uploads.strikinglycdn.com/files/2b6879ec-9bb6-4c4f-87dc-c5601045566e/32288618878.pdf
    • https://s3.amazonaws.com/xurixado/lesson_plan_template_elementary.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010161.bin
bdab5cf08b20b98dcdbd820d7a0916d2bd91ba4dc953512b5cabb330b88e32a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10161 5328 bytes
font_01_sfnt_off000113a5.bin
9c7add8dd0855c0a1d5667494b9f93d09ac835753dee6234e86d7f0b6a048ddc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113A5 10648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.