Malicious PDF — malware analysis report

Static analysis result for SHA-256 d92b39f391428877…

MALICIOUS

PDF

78.6 KB Created: 2021-05-08 15:13:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b534fd4f8652fabe87b88fb1f4bfbd27 SHA-1: 2d67ea5415f99ed34c2c9153a0d59efc4b6a75d3 SHA-256: d92b39f391428877675e183d107e6d39835a944ae16d6beb3fae8ddffcdc0734
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, though partially corrupted, suggests a lure for 'Adobe Premiere Pro CS6 logo templates free download'. The presence of an embedded URI pointing to 'vilenefex.ru' strongly suggests the document is designed to redirect users to a site that likely hosts or facilitates the download of malicious content, aligning with a phishing or social engineering attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=adobe+premiere+pro+cs6+logo+templates+free+download
    • https://cdn.sqhk.co/vovawumusa/jNdgegd/archer_hotel_new_york_parking.pdf
    • http://tebapewulodafe.getenjoyment.net/72493196484.pdf
    • https://cdn.sqhk.co/piravasufinu/jbijMhd/vajopumomuni.pdf
    • https://cdn.sqhk.co/nurijodefa/hgOhdAW/17096396024.pdf
    • https://static.s123-cdn-static.com/uploads/4389080/normal_5fc9c37ae3e73.pdf
    • https://cdn.sqhk.co/tazewupo/dggF7hf/27992883502.pdf
    • http://gozimudowojuzun.mypressonline.com/43945091894.pdf
    • https://static.s123-cdn-static.com/uploads/4374359/normal_5fc715379cdb3.pdf
    • http://gukevipagopu.mywebcommunity.org/anganwadi_form_bihar.pdf
    • http://kiwenalod.medianewsonline.com/what_is_the_best_ralph_lauren_label.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/cf6e60f1-96e8-4415-9ccb-f5cece2ca592/gokesabenosizipixozago.pdf
    • https://uploads.strikinglycdn.com/files/bd575aba-9af4-40c7-9fbf-d3c3e9bef489/jivesa.pdf
    • https://uploads.strikinglycdn.com/files/1852a7ed-2b8b-43a0-ab81-47e253c71acf/t-maxx_2.5_wheels_and_tires.pdf
    • https://uploads.strikinglycdn.com/files/8b51c740-2229-4900-bff6-4c45a55a1d1c/37904911828.pdf
    • https://uploads.strikinglycdn.com/files/4997ed8d-52bf-421b-923c-6d38ce404aef/87622187869.pdf
    • https://uploads.strikinglycdn.com/files/31cafccd-3a32-45b4-b00e-2997fd4c84a2/how_many_rides_does_disney_california_adventure_have.pdf
    • https://uploads.strikinglycdn.com/files/f6fdbb54-9944-48bb-9f28-bb8ef96fefd3/kajiz.pdf
    • https://uploads.strikinglycdn.com/files/b11558a1-acd8-4e15-9bd4-cf58a190c3b5/why_does_my_canon_printer_turn_off_by_itself.pdf
    • https://uploads.strikinglycdn.com/files/4a3cebc6-5f45-484b-b162-263062f0d1cd/differential_equations_with_applications_and_historical_notes_solutions_slader.pdf
    • https://uploads.strikinglycdn.com/files/992a04c3-ae52-4d4a-993c-88a1acebfb29/ley_de_propiedad_horizontal_en_venezuela_vigente.pdf
    • http://sivikonalijuto.myartsonline.com/90031078788.pdf
    • https://uploads.strikinglycdn.com/files/26445519-6d2d-4554-8d5b-e082c0b6f65b/is_pimping_legal_in_australia.pdf
    • https://uploads.strikinglycdn.com/files/3b6f6285-3e60-4c8e-ab7e-fd517535dab3/integrated_chinese_level_1_part_1_lesson_9_workbook_answer_key.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f32b.bin
476f57b5e522b4440fb0e8706baf69a9224a6f17cd38b7debe3230066f5378a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF32B 5848 bytes
font_01_sfnt_off0001070b.bin
002953577fcea95eb4f97ecaca0d04a91f1222adf7c1f1fbd07ddc6da0dcdefd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1070B 10388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.