Malicious PDF — malware analysis report

Static analysis result for SHA-256 e49b89da06d80ad9…

MALICIOUS

PDF

76.2 KB Created: 2021-03-07 00:23:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0c12fac502138e945d964679ffb5988c SHA-1: d6ef665c6ad2351db4d12d77901dda54111e0177 SHA-256: e49b89da06d80ad912923bdf3315151249cf107e91ce286a23d9e82a6b4b6912
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a payload or redirect the user to a phishing site. The presence of a visual download button further supports the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=the+a+team+movie+download+in+hindi+480p
    • http://ourfutures.space/59483368155txi5v.pdf
    • http://gemofesane.medianewsonline.com/is_the_game_of_thrones_book_series_done.pdf
    • http://fuzubijixulux.mygamesonline.org/how_to_burn_wheel_in_automatic.pdf
    • http://lnstagram-help-businesss.com/exam_timetable_unisa0ubyl.pdf
    • http://o-karte-kopilka.com/jack_reacher_book_series_in_chronological_orderagjbc.pdf
    • http://ewwe.space/attestation_d_hbergement_bnp_paribask0257.pdf
    • http://gisowutuxa.22web.org/127341992.pdf
    • http://inscarusa.info/how_much_does_a_solar_watch_battery_cost2tyap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/33b228d9-ee56-41d1-ad5a-e6789085a2e1/ipad_mini_and_ipad_air_2_size_comparison.pdf
    • https://s3.amazonaws.com/suxuzubojut/ropatidamunibibazitanoz.pdf
    • https://s3.amazonaws.com/jovekus/printable_first_aid_kit_guide.pdf
    • https://uploads.strikinglycdn.com/files/b6d61281-309f-40fa-b72c-92089afc5914/pisobukowonawuriduvigisiz.pdf
    • https://uploads.strikinglycdn.com/files/e18c9a15-5556-40e7-9f15-42878d9a07e5/accu_chek_compact_plus_gt_test_strips.pdf
    • https://s3.amazonaws.com/luropi/accreta_increta_percreta.pdf
    • https://uploads.strikinglycdn.com/files/aa5b8147-0d4e-4040-aa11-742fe137c97d/vujolimosefamafu.pdf
    • http://mimarenunev.rf.gd/jeep_xj_rocker_panel_rock_sliders.pdf
    • http://bumurulepowele.myartsonline.com/64439339842.pdf
    • https://s3.amazonaws.com/xukanomarexumu/manual_bmw_x1_2013_espaol.pdf
    • https://uploads.strikinglycdn.com/files/c063bbb2-a178-4ec5-aa4f-7c53e0af0af3/mefimuwofowe.pdf
    • https://s3.amazonaws.com/wozowuledij/wibiletite.pdf
    • http://farapatenaru.rf.gd/fried_catfish_nuggets_nutrition_information.pdf
    • https://s3.amazonaws.com/wofaxil/fugifunofulanox.pdf
    • http://lirepotinemos.rf.gd/pofunuburewizugeterez.pdf
    • https://s3.amazonaws.com/tifuwuw/ralavilikibexolivote.pdf
    • https://s3.amazonaws.com/desekusoxi/canoscan_lide_300_user_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eca4.bin
bfcb22c64ff0f524e2c92d9ea547207f4c7d87f5086c939c678c0bb0f9932313		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECA4 5448 bytes
font_01_sfnt_off0000ff24.bin
77fc1b5c483a4821970ee3ae6c22e1494aa1a7746fd85433a131c8d27ad65a12		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF24 10428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.