Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9640c78aed16bb1…

MALICIOUS

PDF

70.6 KB Created: 2021-04-03 11:45:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f46ba38ee50ce981eb6555b483ff2c21 SHA-1: 70972d180747f732cd60ef040f71c166946ea967 SHA-256: d9640c78aed16bb1ade1aeeea6acd8b6db508bb60a993ce80d42adaf6aa446b2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The embedded URL likely leads to a malicious site designed to exploit or deceive the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=punctuation+marks+worksheets+pdf+for+grade+2
    • http://lumogodasekepi.mypressonline.com/acreditacion_de_busqueda_activa_de_empleo.pdf
    • http://jidokove.scienceontheweb.net/pdf_file_size_reduce_below_2_mb.pdf
    • https://static.s123-cdn-static.com/uploads/4455883/normal_600540fe525bc.pdf
    • http://nufivuzelikonax.getenjoyment.net/50766066803.pdf
    • http://vavazexowupex.medianewsonline.com/what_is_the_legal_age_for_sexually_active_in_us.pdf
    • http://sitizinudex.getenjoyment.net/family_feud_rules_points.pdf
    • http://dogalijun.scienceontheweb.net/2004_dodge_ram_1500_brake_light_bulbs.pdf
    • https://cdn-cms.f-static.net/uploads/4425209/normal_605cb561013dd.pdf
    • http://raxajifiwovoj.iblogger.org/13448234102.pdf
    • https://static.s123-cdn-static.com/uploads/4493201/normal_600349068cff5.pdf
    • https://cdn-cms.f-static.net/uploads/4375355/normal_602768b3da833.pdf
    • http://zorimiba.iblogger.org/wogij.pdf
    • http://sabovibin.medianewsonline.com/tilting_pad_journal_bearing.pdf
    • http://tuzotumefakorok.scienceontheweb.net/85217553325.pdf
    • https://cdn-cms.f-static.net/uploads/4485448/normal_6036d8e3c0003.pdf
    • http://levupag.22web.org/33508063712.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xikusaduxofi.atwebpages.com/vojijila.pdf
    • http://bumejefivoxigo.myartsonline.com/sample_business_proposal_letter_for_services.pdf
    • http://bebovufuvuji.myartsonline.com/skoda_karoq_dimensions.pdf
    • http://dizigudaz.epizy.com/etiology_of_type_1_diabetes_mellitus.pdf
    • http://vakizonozajaxe.onlinewebshop.net/awas_yojana_form.pdf
    • https://uploads.strikinglycdn.com/files/57bc9dd5-da7e-43f1-a7a4-c12be2f5032b/danby_premiere_dehumidifier_manual_r410a.pdf
    • https://uploads.strikinglycdn.com/files/432580be-94b1-47ad-969d-dd99a1421da7/how_to_pass_prince2_foundation_exam_tips.pdf
    • https://uploads.strikinglycdn.com/files/9bbb69bd-3a1a-4967-b02f-4766f3e3b674/76848338873.pdf
    • https://uploads.strikinglycdn.com/files/f40d3340-4c75-4085-baf1-e8c5bb73b002/vojuveputinosudok.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d50f.bin
717019956bd2ed161bb506ee0011a4a958e2e5fe721d46495871103f9bdbb533		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD50F 5824 bytes
font_01_sfnt_off0000e8d4.bin
8d249b8bad67c05e9cbfc648deaa20ced57c4765bf60df000c8165b747fe6f5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8D4 10500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.