Malicious PDF — malware analysis report

Static analysis result for SHA-256 f208253d724990cc…

MALICIOUS

PDF

691.2 KB Created: 2021-05-30 23:04:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a6e79d27d66ca55cdbbdba3646df9236 SHA-1: 5117b41ad39eb4db622d1791dd85484995684b04 SHA-256: f208253d724990ccc496eb395faf456e96cb8bd03a798bacab06dc34e7d4aa99
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains lures indicative of an advance-fee scam, instructing the user to enable content to proceed. It also embeds external URIs, suggesting it is designed to redirect the user to malicious websites. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7169

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=how+wide+is+a+sheet+of+corrugated+iron
    • https://nopufara.weebly.com/uploads/1/3/3/9/133999240/rilifekinigesapov.pdf
    • https://static.s123-cdn-static.com/uploads/4387718/normal_600539e57c12a.pdf
    • https://monivewuvafa.weebly.com/uploads/1/3/4/0/134096064/tewemalujufetomepex.pdf
    • https://zevigetadafuwun.weebly.com/uploads/1/3/0/9/130969942/1242674.pdf
    • https://cdn-cms.f-static.net/uploads/4464715/normal_5feaebaa2991f.pdf
    • https://xeninudi.weebly.com/uploads/1/3/3/9/133997188/lopasoneraj.pdf
    • https://pepotojil.weebly.com/uploads/1/3/4/9/134900045/bedavajepo.pdf
    • https://pogixovupo.weebly.com/uploads/1/3/4/6/134690118/nejavakuponakafuku.pdf
    • https://mizipajosufajod.weebly.com/uploads/1/3/4/0/134040675/zivopamiloja_jiluwez_riwororumelatip_dilatezuvupib.pdf
    • https://cdn-cms.f-static.net/uploads/4452148/normal_60125ffa62f0f.pdf
    • https://puxamosawakexa.weebly.com/uploads/1/3/1/3/131381243/7196244.pdf
    • https://suzagosezamonu.weebly.com/uploads/1/3/4/4/134446802/6422367.pdf
    • https://vidasukesidi.weebly.com/uploads/1/3/4/7/134731400/nuxokikada.pdf
    • https://bofuvozera.weebly.com/uploads/1/3/5/3/135331850/wegid.pdf
    • https://giwedogifuj.weebly.com/uploads/1/3/4/7/134741463/vuneze.pdf
    • https://ronawidafaleso.weebly.com/uploads/1/3/4/5/134504313/motenojiner_madokipojita.pdf
    • https://witiderinusoj.weebly.com/uploads/1/3/1/4/131483097/4456495.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a165f0ae-78ef-4c0a-93db-1223eab51ca4/40278015193.pdf
    • https://uploads.strikinglycdn.com/files/baac9773-d545-436d-8054-d5edc9f6cdd9/how_much_does_the_us_post_office_charge_per_pound.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000a4632.bin
73591696de7f66a1e8c3c86b0e7284b26d7870945dde1a1e46211d7303300653		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4632 12168 bytes
font_01_sfnt_off000a6d18.bin
098e1274d61b0c35d8165f58c646f83cee1272c587a2e21f51f7e0289e5e9077		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA6D18 5304 bytes
font_02_sfnt_off000a7f3b.bin
568d3d09f6e64808078d90123b58b07d9860049b5a4ae4f74232c1662394616e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA7F3B 19684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.