Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9311719c275e925…

MALICIOUS

PDF

145.9 KB Created: 2021-04-06 09:17:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b1ac37a19d9ab4d637627ab481bade55 SHA-1: 287596d7388955bb4d5b7b0aa3d9e6d7a6efade1 SHA-256: e9311719c275e925843411de0a64b98f3d92072364d2a4bf8e0775551db67e0c
216 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document that contains multiple heuristics indicating malicious intent, including advance-fee scam lures, password-protected archive lures, and MFA phishing lures. The embedded URL points to a domain associated with award notifications, likely a phishing pretext. ClamAV also detected this file as Pdf.Phishing.Trojan. No scripts were extracted, but the presence of multiple phishing-related lures and suspicious URLs strongly suggests a malicious document designed to trick users into revealing information or downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=best+pdf+reader+windows+reddit
    • http://creditreportus.info/choreography_video_songstso05.pdf
    • http://ketaton.mywebcommunity.org/veni_creator_spiritus_accordi.pdf
    • https://cdn.sqhk.co/jiloduvunilu/ZXZcgde/6354299938.pdf
    • http://opssmall.space/65455580129tk4iq.pdf
    • https://betunujaxub.weebly.com/uploads/1/3/1/6/131636576/vosowikimiju-lalipikewobaren.pdf
    • http://titanof-filtr.ru/texilawce87.pdf
    • http://tizezs.xyz/unfair_advantage_lean_canvas_definitioni3jnw.pdf
    • http://vinnipoh.space/71988009137oszs.pdf
    • https://nedatukurugajim.weebly.com/uploads/1/3/6/0/136022322/daxuloben.pdf
    • https://cdn.sqhk.co/riraxizilob/ibvvAch/pujisel.pdf
    • http://crispyset.online/motorola_sb6121_spectrummwekg.pdf
    • http://mignonette.space/how_to_use_free_fonts_on_cricutngug3.pdf
    • http://bewewafip.scienceontheweb.net/how_to_write_a_personal_reflective_essay.pdf
    • http://miiliioner.xyz/44424439473qxsvt.pdf
    • http://gekiwejal.scienceontheweb.net/46884567404.pdf
    • https://fexejazawipezes.weebly.com/uploads/1/3/4/8/134869354/6cac28940e7c9.pdf
    • https://cdn.sqhk.co/vorebilifi/iehekjf/zombie_monster_truck_remote_control.pdf
    • https://cdn.sqhk.co/moxulofilose/igURJxe/51208516933.pdf
    • http://fbdirect.site/18223202388fmp9p.pdf
    • https://puwulafu.weebly.com/uploads/1/3/5/3/135329465/504b4f927.pdf
    • http://rufawefojag.sportsontheweb.net/bmp_image_to_converter.pdf
    • http://harkateine.fun/315719540260iq83.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://manuwakagekewu.onlinewebshop.net/social_media_branding_strategy.pdf
    • http://bitujiduruv.myartsonline.com/crown_princess_cruises_deck_plans.pdf
    • http://dapekafuxururo.myartsonline.com/tubijoni.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d520.bin
e07ddfb4f77725ac247bfb2ee9dd404a2f60ff18ce43a6464f1923af4dd55c1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D520 3868 bytes
font_01_sfnt_off0001e2ee.bin
af2d31a4bed931a17cfdc74595e99910d301f9d64bf1507959e1603fefe2fd99		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E2EE 5144 bytes
font_02_sfnt_off0001f492.bin
5fc716ddb9d527aad513d46b38032137fb78d591dc08a57ad1a012d5ff535509		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F492 14604 bytes
font_03_sfnt_off00022411.bin
2173a1880e9f774f759393e7d0d28dda91d04d8a3eae6bea41b822770b343b90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22411 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.