Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5bd5ac98a4ae9d7…

MALICIOUS

PDF

97.4 KB Created: 2021-03-09 17:46:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd2b9849181f043782fd8c4b728f2f6b SHA-1: 22b53362b8dff6ec8dd1c8b15d81cf65c14b78e4 SHA-256: f5bd5ac98a4ae9d754bd47eccb53a4753d798cd65d6573e1a37e0f954e3c7b95
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected by ClamAV as Pdf.Phishing.Trojan and an ML classifier flagged it with high confidence. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to open a password-protected archive, a common tactic to bypass gateway security. The embedded URL points to a domain associated with phishing lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=symmetric+matrix+eigenvalues+pdf
    • https://cdn-cms.f-static.net/uploads/4391000/normal_6020144ae2b45.pdf
    • https://cdn.sqhk.co/fejovuwov/pOVjcih/rafapoxatuvagajotiwo.pdf
    • https://cdn-cms.f-static.net/uploads/4476421/normal_600a44a8e1a55.pdf
    • http://wejowadizabudex.mypressonline.com/pupogavagenobipefonuri.pdf
    • https://cdn-cms.f-static.net/uploads/4376120/normal_601b7d4e5e94e.pdf
    • https://judexibegajojid.weebly.com/uploads/1/3/4/8/134885636/ed92d03ab575fb1.pdf
    • https://falojabuvo.weebly.com/uploads/1/3/4/7/134774067/zulusobasurojesixe.pdf
    • http://tokudujadi.medianewsonline.com/36529139489.pdf
    • https://cdn.sqhk.co/vasozaponem/aQUjgie/93183123312.pdf
    • https://cdn.sqhk.co/givogaduta/oObjguV/hideous_definition_synonyms_and_antonyms.pdf
    • https://static.s123-cdn-static.com/uploads/4485569/normal_5fff4ac01650a.pdf
    • https://cdn-cms.f-static.net/uploads/4379984/normal_5fd61dabd37bd.pdf
    • https://fusesekomufe.weebly.com/uploads/1/3/1/6/131606177/ea655ffb2.pdf
    • https://cdn.sqhk.co/geruvijiwiw/GHgVheA/apartments_for_sale_in_oia_santorini.pdf
    • https://cdn.sqhk.co/dodirijobadi/emAUggb/29723374841.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/da3bee9c-f35c-4cab-aeb9-58e6d77d4229/85094223468.pdf
    • https://7d6e376e-1ee3-4df5-88c1-8d1511d419f8.filesusr.com/ugd/7dd30d_03c0af749df04d0e997ee91c84b382c2.pdf?index=true
    • http://kikukuvikato.myartsonline.com/zifovudenetinutozofozu.pdf
    • https://uploads.strikinglycdn.com/files/91bb6708-a33e-4094-9567-e93e598c1379/48759059463.pdf
    • https://uploads.strikinglycdn.com/files/9a811d43-694d-4050-92e2-3a5bc95f2914/what_is_the_default_password_for_kali_linux.pdf
    • https://64e1471b-64f8-4582-b127-b1692805dd1b.filesusr.com/ugd/507a3d_0b72bd56c04b4928b7dbc6f488e03fe3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/56feb6be-46ea-41d5-845e-5350023def29/the_american_history_book_mcdougal_littell.pdf
    • https://03dfb0eb-7fe6-4188-ad87-ea2b88df7b19.filesusr.com/ugd/f967ac_0c2e9f84198e45e795c50ef5d5b4040c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011333.bin
321218067013d167bba8a76caf5c9675a5cd7355da82d397b62bb6a72a9beb40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11333 2872 bytes
font_01_sfnt_off00011d6f.bin
caaca3c80fd281863ace6a6de7b4a15f34ffca42d1cf589b2e264ca29ee36fe6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D6F 5808 bytes
font_02_sfnt_off00013133.bin
f053a7d4f16be367b1e6d0578141bffa5914ecb671e38c2196bfa7b7607c25d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13133 14904 bytes
font_03_sfnt_off00016026.bin
d3f53c74101dbc1179f9be9cb54615af3fdc3e1be1db1a1bff620458762843de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16026 16664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.