Malicious PDF — malware analysis report

Static analysis result for SHA-256 e528112ef5e9e1a8…

MALICIOUS

PDF

88.1 KB Created: 2021-03-17 19:10:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 74185c87686ea14240b132cab2e74dc7 SHA-1: 213ccc5408f14eb17b26d8f019d570ecde87922c SHA-256: e528112ef5e9e1a8efff9a903915934673a269336f84877ef02ee0f56a91418d
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading a payload. The presence of a visual download button further supports the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=ppsspp+gold+apk+free+download+2020
    • https://buliduxefexefux.weebly.com/uploads/1/3/1/6/131636978/1766969.pdf
    • https://static.s123-cdn-static.com/uploads/4454973/normal_5fcb4979ca33f.pdf
    • http://rorezorejadij.iblogger.org/7915741716.pdf
    • https://wazajodowefode.weebly.com/uploads/1/3/4/0/134017502/tikabexer.pdf
    • http://lajibodomemebev.66ghz.com/57336271805.pdf
    • https://gawakugoful.weebly.com/uploads/1/3/4/7/134757428/marobax.pdf
    • https://cdn-cms.f-static.net/uploads/4464539/normal_6047f70c11e88.pdf
    • https://cdn-cms.f-static.net/uploads/4417141/normal_6040e91052247.pdf
    • https://static.s123-cdn-static.com/uploads/4477139/normal_5ff6a88146e2f.pdf
    • https://cdn-cms.f-static.net/uploads/4379614/normal_5fd7a595201c8.pdf
    • http://nakezubelakibe.22web.org/baidu_wifi_hotspot_32_bit.pdf
    • https://fosobezi.weebly.com/uploads/1/3/4/8/134898374/xezewafefekoxox.pdf
    • http://zezitil.22web.org/a5_envelope_size_guide.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_5876ee82af1e442db62181f880d3b6d2.pdf?index=true
    • http://zupifimiture.rf.gd/40402020371.pdf
    • http://xixepobubin.epizy.com/bootable_windows_10_pro.pdf
    • https://f516a5e5-1936-4b34-b436-a929b3a34b8d.filesusr.com/ugd/774001_9d862c8875bc44f086d3038931c9ee20.pdf?index=true
    • http://torisesajew.rf.gd/blood_in_blood_out_movie_free.pdf
    • https://uploads.strikinglycdn.com/files/1c613caa-5c84-4cf8-b56e-a1b07bea1d50/what_are_some_examples_of_newtons_second_law.pdf
    • http://todogeduwogowev.epizy.com/argument_essay_outline_template.pdf
    • http://boterafozove.rf.gd/57955794742.pdf
    • https://uploads.strikinglycdn.com/files/2023fa2f-f55f-4f30-9d30-3ee565787abe/welusiroju.pdf
    • https://uploads.strikinglycdn.com/files/fce30436-dde9-4d38-b2cb-517aab307baa/ics_400_student_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f51f.bin
06e2bffa533ba57edbb946e05a80fb34a21ab6203d382f06c4ee66fc52953a9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF51F 5300 bytes
font_01_sfnt_off0001073b.bin
ee1649799e1711d89dde22fb70f73b70de9810c4e0147ef149927c3b75030374		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1073B 11888 bytes
font_02_sfnt_off00012f59.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F59 16204 bytes
font_03_sfnt_off00014486.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14486 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.