Malicious PDF — malware analysis report

Static analysis result for SHA-256 de9549c915ec937a…

MALICIOUS

PDF

273.5 KB Created: 2021-03-24 08:44:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 3b6f377c7d013f25d6afc6dd55bf1b47 SHA-1: 54c34392136de5c1ea6686a400fcfc93c1623201 SHA-256: de9549c915ec937a6d3812be9ea33e6acf8233f4e147d6d11927b52a61af092e
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an external URI pointing to a suspicious domain, and ClamAV detected it as a phishing trojan. The presence of a visual download button suggests a lure to trick the user into downloading a malicious payload. While no scripts were explicitly extracted, the PDF structure and external links indicate a potential for malicious content delivery, possibly via embedded JavaScript.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8027

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=angry+birds+epic+mod+apk PDF link annotation
    • https://cdn.sqhk.co/jimatoju/k5LTigV/95068235522.pdfIn PDF document text
    • https://dusonomikeka.weebly.com/uploads/1/3/2/6/132695238/8339128.pdfIn PDF document text
    • https://cdn.sqhk.co/zidodovare/jeBUBhf/best_cowboy_boots_for_extra_wide_feet.pdfIn PDF document text
    • https://cdn.sqhk.co/budatumibowu/MjiDycM/super_fancy_pants_adventure_flash_game.pdfIn PDF document text
    • https://cdn.sqhk.co/nitunoda/Mkhhcem/ruberutup.pdfIn PDF document text
    • http://faxusupovetek.sportsontheweb.net/75963166621.pdfIn PDF document text
    • http://wegoluxetas.scienceontheweb.net/bukujinarozomutorumejet.pdfIn PDF document text
    • https://motovonesavot.weebly.com/uploads/1/3/4/6/134690882/tomij_wanafawonavez_xizujarikoke.pdfIn PDF document text
    • http://tojuvapemupo.mywebcommunity.org/les_miserables_movie_trailer_1998.pdfIn PDF document text
    • http://fegivate.medianewsonline.com/91683612425.pdfIn PDF document text
    • http://tohld.in/pronoun_worksheets_grade_4gafg2.pdfIn PDF document text
    • http://nonretloli.site/modern_biology_textbook_nigeria1zfhz.pdfIn PDF document text
    • http://digtalcaliper09.xyz/how_to_hook_up_rca_soundbar_to_element_tv6munx.pdfIn PDF document text
    • http://manamuposa.getenjoyment.net/nupuxupige.pdfIn PDF document text
    • https:///www.minecraft.net/helpLEARNIn PDF document text
    • https:///www.minecraft.net/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_8535088f36494a71a2e62e6935f45d27.pdf?index=trueIn PDF document text
    • https://47f996fd-8e57-4de1-b9ea-1bffeedbadfe.filesusr.com/ugd/1b0481_4bef68b6c92f4d168464ba67f2f87d53.pdf?index=trueIn PDF document text
    • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_7df01cd8655c4998945b5e48ad74ad2f.pdf?index=trueIn PDF document text
    • https://ed4d48c2-14ea-47f5-a89a-b82193587323.filesusr.com/ugd/8ce377_8857277e202949fba53ff26a262cb3d3.pdf?index=trueIn PDF document text
    • https://a44a9d9e-3ce9-422e-9b5d-83ef2d4925cb.filesusr.com/ugd/3234e9_f1ccdaef578a4f638f7f20768d82044b.pdf?index=trueIn PDF document text
    • https://a39ac558-8fe8-437d-9e10-dc9402d6cb9c.filesusr.com/ugd/1ebe14_f4fc3b1ff37945939a67c1552f7f3790.pdf?index=trueIn PDF document text
    • https://75ca6b5e-a470-4e0e-8004-b00a9f1721b4.filesusr.com/ugd/1e4819_a99ac8cd6e764ee38f447b813a345203.pdf?index=trueIn PDF document text
    • https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_c2c7e3d70326414e9623185fd163bd71.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003b321.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B321 6588 bytes
SHA-256: 24fd6868f187b5667792517f9f69d22ac5a3de5011d4d3824467392effeade79
font_01_sfnt_off0003c36a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C36A 3876 bytes
SHA-256: da498e9218bb6fc674d567d3b3dd1defcb2798ae21e94437bdf214a2dc73eae4
font_02_sfnt_off0003d150.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D150 5656 bytes
SHA-256: c71d873eb167f7d821a463c249a31a37ed9668a84156ab21064ecd1b53335aa8
font_03_sfnt_off0003e479.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E479 1676 bytes
SHA-256: 977d5b364eb14ed17297b5f3f5306473acce96ef9e8455a9f1b622f42a67ba01
font_04_sfnt_off0003eceb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3ECEB 15096 bytes
SHA-256: 9e16b2adeb8ffcd4a8dd240ebd36b0618761524df7f36c9648ec2c35b3c4119c
font_05_sfnt_off00041c4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41C4E 16864 bytes
SHA-256: 172f4a81b3dcdf16130d2bb5ed47b3bde974ef0e24ffd75ada6767a049e351c0

Open this report in the interactive analyzer, or submit your own file for analysis.