Malicious PDF — malware analysis report

Static analysis result for SHA-256 d195a670a739dc15…

MALICIOUS

PDF

77.4 KB Created: 2021-04-17 00:33:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5463ccaccdacd62fa8e15b099f9795c3 SHA-1: ba22071d03e3f3ac8b56bd80207ca3c7c2054d05 SHA-256: d195a670a739dc15f46b1b4a97c4573f475a3c00f0b7011a82e3c7def43fc6eb
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely attempts to trick the user into believing they need a password to access an archive or attachment, a common tactic for evading gateway security. The embedded URL points to a domain known for hosting malicious content, suggesting it's part of a download chain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=rt-n66u+factory+reset
    • http://kexedeziferu.sportsontheweb.net/watudofolabexogexufurero.pdf
    • https://gulapizebulo.weebly.com/uploads/1/3/1/0/131070336/sepivejaben.pdf
    • http://tapodozinojet.mypressonline.com/rig_veda_download_gujarati.pdf
    • http://volalagokiva.sportsontheweb.net/85382239060.pdf
    • http://bagerisevi.scienceontheweb.net/zedodew.pdf
    • https://pobikutilun.weebly.com/uploads/1/3/4/8/134871216/tilurima.pdf
    • https://cdn.sqhk.co/furafurume/F2jcwjj/incredible_journey_of_the_butterflies_worksheet_answers.pdf
    • http://zilamuro.medianewsonline.com/physical_science_concepts_in_action.pdf
    • https://zoluwapipapak.weebly.com/uploads/1/3/5/3/135321816/1785938.pdf
    • http://vudasuti.mygamesonline.org/64664156620.pdf
    • http://toworugesolur.getenjoyment.net/50325844411.pdf
    • https://cdn.sqhk.co/vusanutoj/mhcIiIh/flexible_flyer_swing_set_instruction_manual.pdf
    • https://xisapidazafov.weebly.com/uploads/1/3/5/9/135961350/cc96bb9503.pdf
    • http://sijubuwejipamun.mywebcommunity.org/avancemos_level_1_workbook.pdf
    • https://cdn.sqhk.co/jotepomi/whjdnkE/73624966151.pdf
    • http://fiwetud.scienceontheweb.net/anamnesis_fisioterapia.pdf
    • http://kekewawoxugar.sportsontheweb.net/la_leccion_de_august_resumen_largo.pdf
    • https://cdn.sqhk.co/zumedizojas/fhhJjiv/glitch_cam_apk_premium.pdf
    • https://lekofubazag.weebly.com/uploads/1/3/1/8/131872104/4122966.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/legipalofi/29632894184.pdf
    • https://s3.amazonaws.com/xotomisen/jodepobekanezafijidurolaf.pdf
    • https://uploads.strikinglycdn.com/files/00a68cab-f3f4-4c4c-9559-ba7724be8af2/rokisukupexejesokexomarif.pdf
    • https://uploads.strikinglycdn.com/files/6762787f-f679-411b-9add-84d641eee664/80380888960.pdf
    • https://uploads.strikinglycdn.com/files/79468388-98e3-4802-b7d4-a347a9ea7d7e/29374103000.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f301.bin
7ee4ac5576f5fa7a5dacaa07051e4663f5a72f602697f8c59ffef1efc2f67290		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF301 5140 bytes
font_01_sfnt_off000104a3.bin
250cf0ac23676367af2210aa2834e4544d768314ceede0c6c6ed5dd34cf121e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104A3 10372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.