Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6a62857362518d1…

MALICIOUS

PDF

105.3 KB Created: 2021-03-13 18:39:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 709a09d57106e92f19ebe488690a2fa0 SHA-1: 751f8cd6ac34a40350e0e180d07e986ba221387d SHA-256: d6a62857362518d15c014b6bdbf6fd5693564944eb55a78ffc28ac1656fbcd4a
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, and exhibits characteristics of an advance-fee scam. The embedded URL 'https://mezovuduw.ru/wix?keyword=bakewise+pdf+download' suggests a lure to download further malicious content. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate it is designed to deceive the user into a fraudulent transaction or to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=bakewise+pdf+download
    • http://easterthjg.com/informacion_de_ballenas_jorobadas_en_inglesxpfbw.pdf
    • https://cdn.sqhk.co/xuxozowaki/shgy7Jy/crunchyroll_free_premium_trial.pdf
    • https://cdn.sqhk.co/virurewev/DXZ4ojb/zomixibomujusu.pdf
    • https://cdn-cms.f-static.net/uploads/4372737/normal_600fd54117b36.pdf
    • https://static.s123-cdn-static.com/uploads/4458824/normal_5fee0fc609d67.pdf
    • https://static.s123-cdn-static.com/uploads/4365624/normal_5ffe08652cb2c.pdf
    • https://cdn.sqhk.co/niserutom/ChfChaq/30509493834.pdf
    • http://instapriz365.online/director_report_of_reliance_2017crhid.pdf
    • https://vexefanakaxaki.weebly.com/uploads/1/3/4/8/134871487/d9851.pdf
    • https://gegotebure.weebly.com/uploads/1/3/1/6/131606057/0e468c5b05.pdf
    • https://bejolikide.weebly.com/uploads/1/3/1/4/131437094/8377662.pdf
    • https://static.s123-cdn-static.com/uploads/4368222/normal_6006ecb2d5ab0.pdf
    • https://cdn-cms.f-static.net/uploads/4367617/normal_603a9d139debc.pdf
    • https://cdn-cms.f-static.net/uploads/4376369/normal_600b3b72a8b61.pdf
    • https://niraxonaweza.weebly.com/uploads/1/3/4/0/134000156/4502891.pdf
    • https://cdn-cms.f-static.net/uploads/4464521/normal_60377833dd01a.pdf
    • https://fuviwezajoz.weebly.com/uploads/1/3/1/3/131379384/4821838.pdf
    • https://static.s123-cdn-static.com/uploads/4409123/normal_5fe0296333610.pdf
    • https://static.s123-cdn-static.com/uploads/4486061/normal_5fcf2f5b2b436.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/nevowimo/free_lagu_chrisye_pergilah_kasih.pdf
    • https://s3.amazonaws.com/dusubonifu/sample_resume_for_experienced_business_analyst.pdf
    • https://s3.amazonaws.com/wovugi/runedelig.pdf
    • https://s3.amazonaws.com/topipovikapari/10482932566.pdf
    • https://s3.amazonaws.com/migivewuwe/maze_runner_books_ranked.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014fc5.bin
b7bca47c189e894b7949ff82559cf70ead718dc70f7726010802625b3b07d882
pdf-font-stream PDF embedded font (sfnt) at offset 0x14FC5 4852 bytes
font_01_sfnt_off00016064.bin
a60956c12de9d55db76aa4f4dfc9c7f7f7a5c4220db2110615c40cfc0629d1c6
pdf-font-stream PDF embedded font (sfnt) at offset 0x16064 12560 bytes
font_02_sfnt_off000188ea.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c
pdf-font-stream PDF embedded font (sfnt) at offset 0x188EA 4324 bytes