Malicious PDF — malware analysis report

Static analysis result for SHA-256 e248e52f4b12568b…

MALICIOUS

PDF

99.2 KB Created: 2021-03-12 19:43:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: a53fa8fc3af7b3f807f873123bba73df SHA-1: c6cdd387e13e4e4da2b767ec4c65c43253543b2e SHA-256: e248e52f4b12568b97448cba0a6756c9f910262aa142ca77556ea1cac5a6c03d
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a callback-phone (TOAD) lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=shih+tzu+breed+information+uk PDF link annotation
    • http://dosubodanes.mypressonline.com/que_es_un_taller_educativo_y_como_se_hace.pdfIn PDF document text
    • http://erogan-encolumbia.site/benisewuxaxokebobuk7jueh.pdfIn PDF document text
    • http://bomepufibawil.scienceontheweb.net/quicken_mondo_patch_2015_download.pdfIn PDF document text
    • https://cdn.sqhk.co/nivavepe/hdicJy5/what_to_spend_yellow_crafter_scrips_on.pdfIn PDF document text
    • http://instapriz365.online/cartoon_dance_tamil_songojznm.pdfIn PDF document text
    • http://valuburikodajad.medianewsonline.com/diropozuvoritijeb.pdfIn PDF document text
    • https://cdn.sqhk.co/nomelafu/hg0Sjah/lily_story_dress_up_game.pdfIn PDF document text
    • http://vuvuga.xyz/velovekusujeborexib16l1.pdfIn PDF document text
    • http://tumbochka.space/vietnamese_book_of_guerrilla_warfarew8pjk.pdfIn PDF document text
    • https://cdn.sqhk.co/zezetemirag/lmicCAH/11465570819.pdfIn PDF document text
    • http://zekifafeter.scienceontheweb.net/guitar_songbooks_online.pdfIn PDF document text
    • http://sollabs.xyz/business_to_start_in_zimbabwe_with_100qu6wa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/vasofirida/bidumerejivuroriberu.pdfIn PDF document text
    • https://s3.amazonaws.com/kuxuxemu/bihar_b._e._d_online_form_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/fedufiporara/td_ameritrade_account_application_form.pdfIn PDF document text
    • https://s3.amazonaws.com/boxujetanonikuv/how_to_pair_blueparrott_headset_to_iphone.pdfIn PDF document text
    • https://s3.amazonaws.com/polojuliragam/87197607867.pdfIn PDF document text
    • http://zagofij.onlinewebshop.net/gupowajuwoxikef.pdfIn PDF document text
    • https://s3.amazonaws.com/wupixufekijax/grimm_season_six_episode_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/sugowubuf/jinamituroz.pdfIn PDF document text
    • https://s3.amazonaws.com/rodigapigeta/9877747542.pdfIn PDF document text
    • https://s3.amazonaws.com/bagisi/67045189720.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013b76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B76 5176 bytes
SHA-256: ae48aa52b86a99911ce421c6057381117a3bf1cd8d822da5152bc3f852083b9c
font_01_sfnt_off00014cde.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14CDE 10692 bytes
SHA-256: 6de94b9961b195f79fed73ae0d0a63e5f7d054498f2e60b4cd264e7b8dac2124
font_02_sfnt_off0001713a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1713A 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.