Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8a425b0c0cf1fd9…

MALICIOUS

PDF

73.0 KB Created: 2021-05-31 21:58:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 60b3ae0c63585d72cd28520538d3315d SHA-1: b25c2e0e57c63b189b4c09faded31fde1ad3d031 SHA-256: e8a425b0c0cf1fd915139997cd0594f3437e2432e374983b02ed5506890e7f1c
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a heuristic indicating an external URI pointing to a suspicious domain. The presence of a 'download button' heuristic suggests a lure to trick users into downloading further malicious content. While no scripts were extracted, the PDF structure and the external URI are strong indicators of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/pbw?utm_term=tamil+rockers.co+2019+movies+download
    • https://lifezudo.weebly.com/uploads/1/3/0/7/130739479/5838772.pdf
    • https://cdn-cms.f-static.net/uploads/4471723/normal_605cba50b0c72.pdf
    • https://mazerobuwi.weebly.com/uploads/1/3/1/3/131398334/vekido.pdf
    • https://cdn-cms.f-static.net/uploads/4387566/normal_6065d5a342291.pdf
    • https://venolebibu.weebly.com/uploads/1/3/5/3/135348563/vizowepogefuxageg.pdf
    • https://cdn-cms.f-static.net/uploads/4387807/normal_602e564824fe3.pdf
    • https://cdn-cms.f-static.net/uploads/4476140/normal_6069e0f542c95.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/43685d8e-650e-4015-b9c7-ee7abf50c71d/wuxamijeso.pdf
    • http://xedidovetaw.pbworks.com/w/file/fetch/144416892/adanga_maru_tamil_movie_download_tamilgun_hd.pdf
    • http://natizasex.pbworks.com/f/nusojigef.pdf
    • http://zufumegi.pbworks.com/w/file/fetch/144423531/vilixeloserovu.pdf
    • https://uploads.strikinglycdn.com/files/e6e4b507-d1be-4baf-b71f-893da6ad9500/is_30_minutes_of_strength_training_enough.pdf
    • http://bovojigu.pbworks.com/f/ratio_of_perimeter_and_area_of_similar_figures_worksheet_answers.pdf
    • http://lugozamuxika.pbworks.com/w/file/fetch/144412515/a_wrinkle_in_time_chapter_5-8_questions_and_answers.pdf
    • http://kapetipubi.pbworks.com/w/file/fetch/144422601/34883525665.pdf
    • http://sepaxebi.pbworks.com/w/file/fetch/144413991/set_up_google_home_on_windows_10.pdf
    • http://kolasotosexu.pbworks.com/w/file/fetch/144414648/biruponozemagikoz.pdf
    • http://tagexoba.pbworks.com/w/file/fetch/144422745/what_to_do_if_your_sharp_tv_wont_turn_on.pdf
    • http://xovelezid.pbworks.com/f/what_does_444_mean_in_a_text_message.pdf
    • http://jesababa.pbworks.com/f/iso_14001_internal_audit_checklist_xls.pdf
    • https://uploads.strikinglycdn.com/files/982427cd-dd7f-41e9-a2bb-1c04dee3bd1a/gitetuvoginugakedekemej.pdf
    • http://visetululiv.pbworks.com/f/how_do_i_find_world_war_1_service_records.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000defd.bin
d9f493553f3d97b62320f43ceeddd6abfc57b16e90d11d4324bfe37130e6e2e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEFD 5764 bytes
font_01_sfnt_off0000f29b.bin
7cecf7ce8523bee85fae34dc27b73291a31becedfeff02e9d982828b0ac40216		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF29B 10744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.