Malicious PDF — malware analysis report

Static analysis result for SHA-256 f300fa3ebf5dc7e6…

MALICIOUS

PDF

98.7 KB Created: 2021-03-11 15:08:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-29
MD5: 023f2ca2f221a31d6d574cf351833e79 SHA-1: d043c170c16503cd2a9ce4e6558f778ecb1652cc SHA-256: f300fa3ebf5dc7e6db8e42806d49b87279242e6d76ac3813e66fc39090a742a0
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document body contains garbled text but the presence of an external URI and a heuristic indicating a security bypass instruction strongly suggest a phishing or malware delivery attempt. The embedded URL is likely used to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=crack+win+7+chew-+wga+0.+9 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4501634/normal_6018e48cec271.pdfIn PDF document text
    • https://cdn.sqhk.co/jogekiluse/jaVl2ka/gutekuloreboxavakojej.pdfIn PDF document text
    • http://vevapefin.sportsontheweb.net/how_to_get_jobs_as_a_freelance_graphic_designer.pdfIn PDF document text
    • https://cdn.sqhk.co/fumodolanes/aqCFjhe/guxokeketugow.pdfIn PDF document text
    • https://cdn.sqhk.co/naliwanik/agcvbur/symmetry_board_casual_memory_games_for_seniors.pdfIn PDF document text
    • http://zodelem.mygamesonline.org/www_cbse_nic_in_2020_class_10_sample_papers.pdfIn PDF document text
    • https://cdn.sqhk.co/sexasegavon/bcIkEYc/20657512610.pdfIn PDF document text
    • https://cdn.sqhk.co/jagavibejabe/haGidjb/warriors_game_ps2.pdfIn PDF document text
    • http://laketofetujeso.medianewsonline.com/application_for_employment_template.pdfIn PDF document text
    • https://cdn.sqhk.co/mefivujosawo/ijhfjdp/kutazopar.pdfIn PDF document text
    • https://cdn.sqhk.co/ronelejibir/WLjikhd/xibenokejulurozaxixonive.pdfIn PDF document text
    • https://cdn.sqhk.co/sikudile/hAKAEja/jagomuxepewof.pdfIn PDF document text
    • https://cdn.sqhk.co/wurivado/MapKji1/icivics_one_big_party_vocabulary_answers.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444095/normal_603d7d9abc1f6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476420/normal_602c31d60dfef.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/003f9f7c-5e93-4a72-9fea-5287daad9444/kebopifagipifuxexoge.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97444ecb-44a2-46b9-af2f-5c44a23bfcc7/honeywell_th9320wf5003_battery.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1d49d1a-7d67-4636-b72d-26a810c4982b/la_doctrina_monroe_y_el_destino_manifiesto_resumen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad85d8ec-1c86-40ee-9d29-237bbd5ecca0/fifty_shades_of_grey_movie_download_dual_audio_300mb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6895dd61-9e4a-46ef-b463-e4277aa6c4ca/sexejuzutewefelukuvedum.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ddccc55d-0d9f-4c04-bdc3-1f319d81c295/datikejexanabironoki.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ffb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFB9 6832 bytes
SHA-256: 40e0ad21b19df3db216fd06b1281b08faf1616a5a4e0e4362360d049e0fe8d6c
font_01_sfnt_off00011108.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11108 5072 bytes
SHA-256: ee360059392f02b14a131ec8ccc953c5234ee18285abca4b0eb8364978071ef1
font_02_sfnt_off00012257.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12257 4708 bytes
SHA-256: 0d73d4ebac35ec78260efe9f1bed89638987f112724e79bf202975eca0492205
font_03_sfnt_off000130e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130E8 11372 bytes
SHA-256: 505e4c21f7e807e8b3ab8f1117334bfd06954b993622479420998c75809d2d4b
font_04_sfnt_off000157e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x157E6 16384 bytes
SHA-256: eee1583fea9847b83f52b0ee348f58bc9e5a33bf207d5883ce42d32483f41c42
font_05_sfnt_off00016df4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16DF4 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.