Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee5e8ff12f443e06…

MALICIOUS

PDF

80.4 KB Created: 2021-03-31 20:15:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 41fa174c118a93579d0e06d50090d953 SHA-1: efc85063ce3f1e8dfe0f24db0e8c4c41e9a03049 SHA-256: ee5e8ff12f443e060e16b0af937acca10e6f129377ec40c6337d113a1b135804
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to downloading a book, and an external URI points to a URL that appears to be a lure for a download. The presence of embedded URLs and the ML/ClamAV detections strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=automobile+engineering+book+pdf+free+download
    • https://cdn.sqhk.co/mapetidul/nQJijif/37513772295.pdf
    • https://cdn-cms.f-static.net/uploads/4375339/normal_6031b8d1d00c0.pdf
    • http://fakurivevid.scienceontheweb.net/job_advertisements_samples.pdf
    • http://3bki.ru/arcore_apk_modmqwq4.pdf
    • https://cdn.sqhk.co/dexavoba/HOibjhb/stickman_revenge_3_mod.pdf
    • https://cdn-cms.f-static.net/uploads/4447107/normal_6055987bf2049.pdf
    • http://italiahot.space/392985349203s1nc.pdf
    • https://cdn-cms.f-static.net/uploads/4404955/normal_6046b87d37c69.pdf
    • https://cdn.sqhk.co/juselivo/geMhibO/open_houses_naples_fl_34119.pdf
    • https://cdn-cms.f-static.net/uploads/4459027/normal_6045ea89747a0.pdf
    • https://cdn.sqhk.co/monekuli/Ggdjcnn/gagejurutogumevupeda.pdf
    • https://cdn.sqhk.co/turanexode/igpXusr/zigzagoon_evolution_shiny.pdf
    • https://cdn.sqhk.co/ximirujusuxo/dGLW3ji/49223470335.pdf
    • https://cdn.sqhk.co/mugukawi/egdniaK/84924483062.pdf
    • https://cdn.sqhk.co/mazasofuw/ibjjhad/air_traffic_controller_starting_salary.pdf
    • https://cdn.sqhk.co/gavezexu/FjhE2ji/giluretusotuluvexapum.pdf
    • https://cdn.sqhk.co/noloxunipe/oUHd9WK/53041162612.pdf
    • https://cdn.sqhk.co/feripamapuv/pSjjria/salesizebip.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wudazebej.atwebpages.com/courtesy_call_letter.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e564.bin
4a6bba796343dbd5366357267b6f920ad5cf1f4ea989659a477031029d0f8764		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE564 5468 bytes
font_01_sfnt_off0000f7fa.bin
7cf8d097582418b1db0c18f3eb61a616e8188ae75bdf1bbc103e526876f96159		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7FA 10828 bytes
font_02_sfnt_off00011d27.bin
461a1578f80084b2f2ca998a6e716936969cc9b33b2976d66eaaa57f6abee57a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D27 16172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.