Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7935cf4dad556c8…

MALICIOUS

PDF

81.1 KB Created: 2021-03-14 22:19:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 46bdaf3d758e0768642ac1ca4a324857 SHA-1: a93255110ac73428ee25a93865f03531f26dd1e4 SHA-256: d7935cf4dad556c81d529ec9cdeb6d08e5fab82ad7081ecc7b5e680da6f31a9a
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains text and an embedded URL that suggests a phishing or scam attempt, masquerading as a document receipt confirmation. The ML classifier and ClamAV detection strongly indicate maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into visiting a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=acknowledgement+to+confirm+receipt+of+documents
    • http://mastericy-chistoty.ru/saxajokewijofae2uaa.pdf
    • http://dovoxijego.iblogger.org/slick_rick_hey_young_world.pdf
    • http://citimart.online/35324785455kyy4e.pdf
    • http://rezolurumo.iblogger.org/sharp_tv_aquos_troubleshooting.pdf
    • http://gordei2d.com/excel_search_value_in_multiple_sheetsqhhn0.pdf
    • http://vengriya.space/31151780953ve49t.pdf
    • http://jegewuzewan.iblogger.org/zepopolako.pdf
    • http://fanilobepewe.sportsontheweb.net/sojaruf.pdf
    • https://cdn-cms.f-static.net/uploads/4455403/normal_600e9360dfcbc.pdf
    • https://static.s123-cdn-static.com/uploads/4489730/normal_5ffe0716c0080.pdf
    • http://ses-sanobrabotka.ru/jirakgjfgp.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bevupun.epizy.com/fozagobelalowemijegu.pdf
    • http://gunubepixel.epizy.com/mowikivitalefulodigilakix.pdf
    • http://fasufigosekuwuw.rf.gd/47682610071.pdf
    • https://uploads.strikinglycdn.com/files/dca15a4c-856e-42ae-b8a1-efba878aa6aa/62536831617.pdf
    • https://uploads.strikinglycdn.com/files/f3cdbc38-b4bc-451b-abf8-8c64703a2655/how_many_reps_when_lifting_heavy_weights_for_an_hour.pdf
    • http://lawaxisagiwog.atwebpages.com/42991277331.pdf
    • http://vipovanur.epizy.com/peparinisosupi.pdf
    • https://uploads.strikinglycdn.com/files/2b28aea9-124e-4845-88c5-cbfe01793149/myles_munroe_books_prayer.pdf
    • http://fatixoromagik.epizy.com/hp_3015dn_printer_driver.pdf
    • http://gufofajosegadul.rf.gd/what_causes_blind_pimples_on_forehead.pdf
    • https://uploads.strikinglycdn.com/files/2addc487-3dd9-4296-8775-609ccda68adc/how_to_adjust_primus_iq_brake_controller.pdf
    • http://muxajetolalet.epizy.com/14371288405.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001026a.bin
51034aa8c7a6b845dcad0cf72969a0a25f87f82d31a149dc2b42fc362469329d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1026A 5408 bytes
font_01_sfnt_off000114e1.bin
5cfdbd88f427c39132e4a58e1629870c91518e776f25d6a29111424c651ed423		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114E1 9988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.