Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8b2d0afb3176424…

MALICIOUS

PDF

300.4 KB Created: 2021-03-19 11:42:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c238261050535053f6dc5ed540bb0ac SHA-1: d09485b5a97a091b2f5b08532e4e37249f134dac SHA-256: e8b2d0afb3176424ad4b345645b78e880af2efd16cd197286324c3f3536135c3
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains an embedded URL that leads to a suspicious domain, likely for payload delivery or further phishing. The heuristic 'SE_CALLBACK_LURE' indicates the document's content is designed to trick users into calling a phone number, consistent with callback phishing or tech-support scams. No scripts were extracted, but the presence of external URIs suggests potential for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9695

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=bharat+acharya+8086+book+pdf
    • http://pochta-24.cc/philips_norelco_multigroom_5000_walmartpbhh0.pdf
    • http://tb-films.ru/star_trek_starship_models_for_sale671oj.pdf
    • http://dimax-matrasy.ru/duzavotubijuzenuloloziwbtwiw.pdf
    • http://otomail.business/41318716645bcie8.pdf
    • http://devgm.design/6801639959by68v.pdf
    • http://123dutch.com/detevunomupubiwodukegakr6w16.pdf
    • http://portkamesto.site/exploration_and_colonization_study_guidemqnep.pdf
    • http://hopecommunitynaz.com/apod._nasa._gov_scale_of_the_universejv58c.pdf
    • http://yesnutural.space/57387714572zrjqu.pdf
    • http://pixell.store/appalachian_trail_guide_central_virginiav4psg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f3dcd8e3-6656-4b47-a81e-a993d3c4f2a1.filesusr.com/ugd/aa9ef2_a81713ae386b4ff097e1eefd6e616ff6.pdf?index=true
    • https://288c7b4b-0494-48f6-8ee2-9dd519b96b0a.filesusr.com/ugd/a107db_8655d40e72b14e7cacd56b358537c452.pdf?index=true
    • https://s3.amazonaws.com/sefepugolupalax/niteruj.pdf
    • http://fajufavutipo.epizy.com/7229972306.pdf
    • http://bobakazof.epizy.com/kogeka.pdf
    • https://s3.amazonaws.com/zunaporam/lakave.pdf
    • https://57fc24c6-ba7c-430a-bdae-05304608b610.filesusr.com/ugd/bc9c68_3574bb802dd64d339e46b338c6ed2c23.pdf?index=true
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_d1c549db764b4a9e8eab4f665dd83012.pdf?index=true
    • https://s3.amazonaws.com/fatikonavori/rizigaxuvojenefodigenopi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000448cc.bin
7fa2701d782663489a721cb9a0135f85572bf779c796889117059407b205b6f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x448CC 5876 bytes
font_01_sfnt_off00045cca.bin
c0a9087d60a3870e44bdccc8e514358d2e1d9f542c1d8bccdeea6dea918de475		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45CCA 14284 bytes
font_02_sfnt_off00048c6d.bin
7b61b80ad9eae8da687db589656cc14036b78b470666db3a00a61726a6371a4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48C6D 16088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.