Malicious PDF — malware analysis report

Static analysis result for SHA-256 e36cfa61281649a5…

MALICIOUS

PDF

137.9 KB Created: 2021-05-15 19:41:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e10ee4490c59e9d6938fb4aabbb99689 SHA-1: 90e85e2e498a23d3a1e63e85fb94613708702b58 SHA-256: e36cfa61281649a5fa3c74890380377a15254de6daa09b2cd7051efaa02daf50
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high ML score. It contains embedded URLs and a heuristic indicating a visual download button lure. The primary malicious URL identified is vilenefex.ru, which is likely used to host or redirect to a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=nutritional+value+chart+of+fruits+and+vegetables
    • http://limecash.xyz/18889803550qgkkn.pdf
    • http://lobulezinovux.medianewsonline.com/bissell_little_green_cleaner_how_to_use.pdf
    • https://cdn-cms.f-static.net/uploads/4465125/normal_601070259a004.pdf
    • http://kittyplay.online/87725629889lpi11.pdf
    • http://lifeit.pro/196653125262lcyc.pdf
    • http://cyberlife.store/34229293219ttgl7.pdf
    • https://cdn-cms.f-static.net/uploads/4365613/normal_606da322ba04e.pdf
    • http://zagavexakagin.mypressonline.com/south_african_school_calendar_2020.pdf
    • http://sunufosabupes.scienceontheweb.net/4003381292.pdf
    • http://nanamojuvimujo.medianewsonline.com/kuvetudo.pdf
    • http://sun-italy.space/42969734541hpv38.pdf
    • https://static.s123-cdn-static.com/uploads/4370097/normal_5ff6d3d517329.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tufelorit.rf.gd/rotebuxadatotevevowu.pdf
    • https://s3.amazonaws.com/muvemasoxaji/45656834833.pdf
    • http://sesugemedolaf.rf.gd/merchant_of_venice_summary_act_3_scene_5.pdf
    • https://uploads.strikinglycdn.com/files/d58fe15d-cc0b-45db-adca-6f894c608863/oracle_sql_and_pl_sql_tutorial.pdf
    • https://s3.amazonaws.com/tufitijinexu/full_form_of_mla_in_marathi.pdf
    • http://zamoguwudegovo.rf.gd/atomic_structure_electron_configuration.pdf
    • https://s3.amazonaws.com/gisujubolidine/logitech_mk710_mouse_not_working.pdf
    • https://uploads.strikinglycdn.com/files/8e211e88-b80c-4888-8db1-96bfae3f8196/mikhail_bakhtin_rabelais_and_his_world_summary.pdf
    • https://s3.amazonaws.com/kezemiradigu/hundreds_tens_and_units_worksheets_year_2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018419.bin
a992af80cd3316e2be997d05da69a63b669cc33c6f9a0373d67a12d17a5eda1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18419 30784 bytes
font_01_sfnt_off0001dfd7.bin
69642b351c71ccaa706dbb7c079b5b74e1abc0e7c0d91db80c43d860b6be7ddb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DFD7 5452 bytes
font_02_sfnt_off0001f266.bin
355b6a1f1c4213f5d783ce50766fcb4fb00197db749ee92400e77774f00fe4ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F266 11344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.