Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5b5c98f671294e6…

MALICIOUS

PDF

80.5 KB Created: 2021-04-28 15:50:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ffc6cbd1bfc6f7a690f375e1d9b91989 SHA-1: 4b716da4adf2d974d1ccf2fc97486cae20ff7ab6 SHA-256: f5b5c98f671294e6f8b4713f63edcf603cd8cfb24af112c06d4ebc06a060e595
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The presence of embedded URLs and a heuristic for a visual download button suggests a phishing or social engineering attack. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'autocad save to web and mobile', potentially indicating a lure related to software or file conversion.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=autocad+save+to+web+and+mobile
    • http://giwewigipebi.medianewsonline.com/4325189600.pdf
    • http://bafedudovodamo.medianewsonline.com/63609994603.pdf
    • http://vasakuso.sportsontheweb.net/holy_quran_app_apk_download.pdf
    • http://thechambre.xyz/gesivawedapuwuburuo4v.pdf
    • http://zurujavurobe.scienceontheweb.net/angioedema_adquirido.pdf
    • http://bodyita.space/93744060246xz462.pdf
    • http://wozonos.22web.org/fl_vehicle_bill_of_sale.pdf
    • http://fotodosajube.22web.org/tilupizodor.pdf
    • https://ravijirigiraga.weebly.com/uploads/1/3/4/6/134649302/xukisijumaxuxusotu.pdf
    • http://kokilubowo.22web.org/57206116645.pdf
    • https://buriviniroxino.weebly.com/uploads/1/3/1/6/131606563/gisumemo.pdf
    • http://gizigevom.mygamesonline.org/73760304717.pdf
    • http://zanodopowe.sportsontheweb.net/32511782006.pdf
    • http://fesuzeroba.iblogger.org/16163961988.pdf
    • https://litazivufili.weebly.com/uploads/1/3/4/3/134305244/juliduwolo-modix-burafamipoduwe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gitodake.myartsonline.com/central_dogma_translation.pdf
    • https://uploads.strikinglycdn.com/files/54962f41-d793-40e7-b1f4-0c8b7c2282a4/the_little_prince_full_movie_download_free.pdf
    • https://uploads.strikinglycdn.com/files/58cd70bb-58ed-4c3a-8ad0-ff1d9c753696/17799954564.pdf
    • http://givemuzod.epizy.com/penatalaksanaan_bronkopneumonia_pada_anak.pdf
    • http://xejawaji.myartsonline.com/33143233565.pdf
    • https://uploads.strikinglycdn.com/files/82f69853-46b9-4f72-a4aa-653da5fc483e/bifarinipuvagowojatikadal.pdf
    • https://uploads.strikinglycdn.com/files/98f7637b-4925-4ae8-b387-b3f97863a2e2/60043671053.pdf
    • https://uploads.strikinglycdn.com/files/873ab2cf-775a-4628-9a94-f22071eaeb37/words_that_start_with_k_to_describe_someone_positively.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e99f.bin
51036caeaaec89de8680405f123e86dc84267b6fe8b2de34ea0e6c667ded1fe3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE99F 4032 bytes
font_01_sfnt_off0000f811.bin
c1861e8c9e3f325320cfefb7ade1a3748563c4899bb2ba3b2048310cf4df1ff3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF811 5268 bytes
font_02_sfnt_off00010a00.bin
421d7379b56db1a693297b1b64998c34a82b35e41bb37570ffe5986e55e7c7c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A00 12084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.