Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6e4724c4465e5a1…

MALICIOUS

PDF

81.1 KB Created: 2021-03-10 07:54:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5df59b5f01f3f6032de01273c89f9c42 SHA-1: dde0e3c6f30863b2049dc21ff129864f226cd55c SHA-256: e6e4724c4465e5a1c6b59a6002faa7388dd0ac95d497e35b5d8a27ba1ac75316
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as a phishing trojan. It contains multiple embedded URLs, one of which is a direct link to a suspicious domain ('vilenefex.ru') that appears to be part of a download lure. The presence of a 'download button' heuristic further supports the phishing and malicious download attempt. No scripts were extracted, but the overall structure and heuristics indicate a malicious document designed to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=apk+mania+utorrent+pro
    • http://j3vnci4.xyz/english_for_beginners_commercialg0pc0.pdf
    • https://niraxonaweza.weebly.com/uploads/1/3/4/0/134000156/mugivobokuv.pdf
    • http://gexuveruk.iblogger.org/the_siren_kiera_cass_plot.pdf
    • http://becloud.website/all_future_tense_exercisesud5xh.pdf
    • https://fopudodesesiwen.weebly.com/uploads/1/3/4/3/134344932/sasodafetubat-fipipiruvimab-suwafimasiviv.pdf
    • http://xivetaf.22web.org/2342408356.pdf
    • http://kernig.store/dodiguju83.pdf
    • http://vilopeg.xyz/vexezaxiziweromo3htph.pdf
    • http://pexukakadom.22web.org/waxofifezadopukupe.pdf
    • https://xuxedujuwa.weebly.com/uploads/1/3/5/3/135345360/newopul.pdf
    • http://gezowipefu.22web.org/vawuzumisasov.pdf
    • https://rugeponejap.weebly.com/uploads/1/3/4/4/134487210/327824.pdf
    • http://girameluxo.iblogger.org/80777882255.pdf
    • https://lixazasowab.weebly.com/uploads/1/3/4/5/134588429/f68fa3.pdf
    • http://universe1.space/my_princess_boynrny8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tatasuvuputo.epizy.com/21383087095.pdf
    • https://uploads.strikinglycdn.com/files/ed60e395-43d8-484e-89a6-eb626c64b29b/66993509690.pdf
    • http://redusaboj.epizy.com/nobubinetazelezaw.pdf
    • http://vagelebab.rf.gd/mechanics_work_energy_and_power_worksheet_answers.pdf
    • https://uploads.strikinglycdn.com/files/76580b12-5329-48dc-999a-e4b7fe01c3ac/spanish_location_words_quizlet.pdf
    • https://uploads.strikinglycdn.com/files/67c9ee3f-4efb-47ca-83e2-22356606d66c/boy_scouts_lawsuit_2021.pdf
    • http://pebitezilewabe.rf.gd/warhammer_40k_8th_ed_rules.pdf
    • http://wufasimateli.epizy.com/7237581339.pdf
    • https://uploads.strikinglycdn.com/files/854bc970-bb4a-46d2-9f87-f91d24825a76/xuzefavafuludi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaa1.bin
2831200b34d96befef67e7ebe99d015f160aeaffd5290762bae5af5f854c4299		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAA1 4808 bytes
font_01_sfnt_off0000fae3.bin
bd82fb2485bbe0b227347765e9c9930f641d7329e87f30181c082337bbd3ed41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAE3 11188 bytes
font_02_sfnt_off0001216b.bin
f0a8b786da721c7415a59d91fbce3b20bbb98ea32e48857ac1ff22d53b00ec29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1216B 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.