Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec3c9874e85c0ea8…

MALICIOUS

PDF

81.8 KB Created: 2021-02-28 19:27:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: df42e5afe1200368ffdddf491bdda0c6 SHA-1: 2426f575acc38b8f5fd7e10bd0741f420e0da49d SHA-256: ec3c9874e85c0ea8e99d8ffd13598da640459d29b7231d67f578c29a1610b47c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a malicious payload or lead the user to a phishing site. The document body, though partially corrupted, suggests a lure related to a health issue ('Burning red bumps on neck') to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=burning+red+bumps+on+neck PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4419637/normal_600e4b7638f59.pdfIn PDF document text
    • http://busivel.xyz/management_reporting_examplesd9h5i.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476133/normal_5ff3f4b86012b.pdfIn PDF document text
    • http://idealica-ituficiale.website/13058120141x6x3s.pdfIn PDF document text
    • http://callup.today/graphic_design_book_free_downloadxhtph.pdfIn PDF document text
    • http://discovljzg.fun/93093207947ona0f.pdfIn PDF document text
    • http://rankingcoach-apps.com/14135034785h35xf.pdfIn PDF document text
    • http://center-san.ru/gabidopemolte5c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500183/normal_5fd68b1ec3f83.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451025/normal_60246b119ab7e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500677/normal_60134eb2a0fe6.pdfIn PDF document text
    • http://trendmobile.ru/samsung_xpress_m2825dw_resetuaj4m.pdfIn PDF document text
    • http://evakuator-uga.ru/loyalty_card_template_ai8ce94.pdfIn PDF document text
    • https://cdn.sqhk.co/sigidezok/jMifRie/rozasiwovomadexadun.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pezofut/the_trial_kafka_characters.pdfIn PDF document text
    • https://s3.amazonaws.com/vonutavekip/ruradozezufosujuto.pdfIn PDF document text
    • https://s3.amazonaws.com/vibasujefir/66077968827.pdfIn PDF document text
    • https://s3.amazonaws.com/lemerisinivum/android_store_value_in_application.pdfIn PDF document text
    • https://s3.amazonaws.com/bodajaku/anton_calculus_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001015f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1015F 5404 bytes
SHA-256: 2b7b1e5c78cfbdea28165b4a4720dd8b48b1b35edd3ee114a3da0b3e3da8b7f7
font_01_sfnt_off000113b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113B1 10964 bytes
SHA-256: 4e7dbf191c57a220e1d6bdcb04dbe4f2c06f993c9d8feed20d1023262ab66aef

Open this report in the interactive analyzer, or submit your own file for analysis.