Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce58319490886a61…

MALICIOUS

PDF

270.4 KB Created: 2021-04-10 21:06:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ecb9ae8694052e8f524a9e60b3b20e00 SHA-1: 1795f3ddeb39381f99ef82088efd23ef8df7547b SHA-256: ce58319490886a6185fc4d3c3857785b30296a6841ba8a6248ab4ff7c46c64b3
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing embedded URLs and is flagged by multiple heuristics as malicious, including a ClamAV detection for a phishing trojan. The document body, though partially corrupted, suggests a lure related to credit titles. The presence of external URIs and the 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicate that this document is likely designed to trick the user into downloading further malicious content, possibly by providing a password for an encrypted archive.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9518

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=los+t%25C3%25ADtulos+de+cr%25C3%25A9dito+como+t%25C3%25ADtulos+ejecutivos
    • https://cdn.sqhk.co/kazakilen/ihiidig/top_up_digicel_guyana.pdf
    • https://cdn.sqhk.co/pakebisas/gFiiz5E/76817936152.pdf
    • http://milansit.space/ragdoll_monster_sandbox_free_ragdoll_physics_games_ps460zxu.pdf
    • http://wide-mean.top/10333695548prw5q.pdf
    • https://cdn.sqhk.co/fujotojaxob/gOjdijL/prison_break_season_4_ending_review.pdf
    • http://baderezu.scienceontheweb.net/my_diary_quotes_images.pdf
    • http://static-start.top/98100757400llq0g.pdf
    • http://vukuradi.mygamesonline.org/nunukupuwomol.pdf
    • http://mamafiposorugul.sportsontheweb.net/literatura_concisa_alfredo_bosi.pdf
    • http://majikok.mygamesonline.org/sulesedikam.pdf
    • http://soldonlakewood.com/42052254492wjvp9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/79a10533-ccf9-4d67-a1be-f9e74470f702/gefupufetebuxe.pdf
    • https://uploads.strikinglycdn.com/files/c1eeb3d7-fd00-41dc-bd31-4f355900cdfa/12535667613.pdf
    • https://uploads.strikinglycdn.com/files/08c1ef34-5846-4908-bc3e-84b0c0600c5e/15042175978.pdf
    • https://uploads.strikinglycdn.com/files/4bbc974a-77d4-4bd0-9038-09db8ace0551/xuwuk.pdf
    • https://uploads.strikinglycdn.com/files/63f634a5-0541-46b4-a804-c9f13c144f87/zonawoziwasasidaresata.pdf
    • http://liroporuki.myartsonline.com/online_banking_services.pdf
    • http://wutejaxevewef.myartsonline.com/are_first_responders_paramedics.pdf
    • http://xixivozute.myartsonline.com/belief_in_a_just_world_scale.pdf
    • https://uploads.strikinglycdn.com/files/d58c879d-056d-435c-a2b0-cb35010c7899/gidav.pdf
    • https://uploads.strikinglycdn.com/files/10f3bf4a-f5f9-4ee6-bd62-4027713e0f5a/how_to_thread_my_singer_tradition_sewing_machine.pdf
    • https://uploads.strikinglycdn.com/files/4ba48fb7-d827-48c2-add1-85dcf2534cb7/99_ford_ranger_automatic_transmission_fluid_type.pdf
    • http://donijexufenu.onlinewebshop.net/65837284400.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003efc8.bin
22c27724942076cbc2ae1bc091091c5197b7444aab6ec41b61f91b58a9b227d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EFC8 5148 bytes
font_01_sfnt_off000400f8.bin
02b6ec2d69f820f5bcac11fe66438e29af51bf4caa21a331f62ce9db02daba1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x400F8 11888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.