Malicious PDF — malware analysis report

Static analysis result for SHA-256 f59a3c5c9decd6c4…

MALICIOUS

PDF

89.4 KB Created: 2021-06-28 03:22:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 47c1a6a6c90772a5877b5894074bcfcd SHA-1: f3b033ff061dfe58d0ca778e133a249a2bafd683 SHA-256: f59a3c5c9decd6c4a5d8c9736aa3a9a3f7ed5f9983e6952ea44597390516336e
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by ML classifiers and ClamAV as malicious, with heuristics indicating it's a callback phishing lure. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the heuristics suggest an attempt to trick the user into contacting a malicious entity. The document's structure and embedded content are consistent with a phishing attempt designed to exploit user trust.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9822

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theydeserveastamp.org/wp-content/plugins/formcraft/file-upload/server/content/files/160ae7af7b412e---35388194494.pdf
    • https://moniimpex.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4751c6004e---rukaxunosavegejegepakomi.pdf
    • https://bbpartner.cz/userfiles/file/wupiraxakurisesisetinu.pdf
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/5i6jkvvu63ajpkqv0cbr1ms0o0/kidizonivasejudojamilonok.pdf
    • http://kondicionery-dolgoprudny.ru/upload_picture/file/fitaze.pdf
    • https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/vi79s9pee287t94venhasgn2kf/japaromusikebezefugi.pdf
    • http://insidethedigitaltrend.biz/userfiles/file/690071334.pdf
    • https://reifenscho.de/wp-content/plugins/formcraft/file-upload/server/content/files/160d466aee5e06---ligelavexebi.pdf
    • https://www.wflorlando.com/wp-content/plugins/super-forms/uploads/php/files/301d7fdb1e3565b3f5f4b94834560fb7/duketovojevafer.pdf
    • http://www.sbawerribee.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608788bf21aaa---72810102417.pdf
    • https://reparation-mobile.net/userfiles/file/dunebututisifipubiguxodu.pdf
    • http://prodesign31.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1608e5e45eed8d---45063808454.pdf
    • http://sinara.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c96adef312c---vunezukizatijavulebegotub.pdf
    • http://ajtoablakcentrum.com/_user/file/bobomegi.pdf
    • https://www.rockandroll.blog.br/wp-content/plugins/super-forms/uploads/php/files/8ih6vmoggtkn4bsvn2a7p24eka/miduvapiwesurikef.pdf
    • http://e-pisanie-prac.pl/famprojekt_z_serwera/images/file/bojipazukimuvajavobisaz.pdf
    • http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a43a597b581---35219906929.pdf
    • http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c032b494a3c---bekaxakib.pdf
    • http://kubabus.cz/novy-web/upload/file/nozulutekidazeno.pdf
    • http://jucal.es/images/file/45335783001.pdf
    • http://stphilomenaonline.org/userfiles/file/54495274576.pdf
    • https://www.ideaklinik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c2eac017c2---gibupixokisadokajazupo.pdf
    • http://51-lq.com/userfiles/file///tixinum.pdf
    • https://bjsteelvietnam.com/upload/fck/file/zefeloxoduvefuva.pdf
    • https://dazzlin.co.uk/wp-content/plugins/super-forms/uploads/php/files/32e5fd58d7fd5a48e9721ac2aea11909/99495615415.pdf
    • http://lafenicealcamo.it/userfiles/files/15275570168.pdf
    • https://parklanehotel.asia/userfiles/file/tuxupovusadomipoviwokuxu.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=brice+taylor+thanks+for+the+memories+pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f91f.bin
413589dd303c5f238e1da56cf62bc8b1fbef15ae3484be3cb5290598d50ad020		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF91F 17152 bytes
font_01_sfnt_off000125ca.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125CA 16792 bytes
font_02_sfnt_off00013de1.bin
afbf9aea1a3430ab141d31eefa083b9adfbd2056f6e2d0e45c0198fbd6766794		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13DE1 11144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.