Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5f2d29b2dc7866b…

MALICIOUS

PDF

78.8 KB Created: 2021-03-18 09:54:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f8e74cc2aafc48cd618292870cea8577 SHA-1: 151b1a12196520e9ff265683298de3bd380e5a00 SHA-256: f5f2d29b2dc7866b3d545ff6486447ce3e8bec59640792bc8ccb0db46cce5ae3
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. The document body, though heavily obfuscated, contains references to a car review and a URL, suggesting a social engineering lure. The embedded URL points to a domain that has been flagged in heuristics, further supporting the phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=2021+ford+mustang+mach-e+select+review
    • https://cdn-cms.f-static.net/uploads/4391925/normal_600c21ff42091.pdf
    • https://cdn.sqhk.co/veludewozen/ifR7gij/free_sudoku_easy_247.pdf
    • http://fogafiv.mypressonline.com/gajeduxesefinufaxob.pdf
    • http://nipokaxa.getenjoyment.net/simple_business_plan_template_free.pdf
    • https://cdn-cms.f-static.net/uploads/4379846/normal_6047f56e0366f.pdf
    • https://cdn-cms.f-static.net/uploads/4461216/normal_5fd0e3d474172.pdf
    • http://xoxapepagaxon.mypressonline.com/geological_map_of_rajasthan.pdf
    • https://cdn.sqhk.co/rifarako/iwbvpg3/22116610733.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wipotegadodorek/diwulabopologinov.pdf
    • http://jotudokizer.onlinewebshop.net/lux_tx9600tsa_programming.pdf
    • https://s3.amazonaws.com/rumezo/86433856030.pdf
    • https://s3.amazonaws.com/lekelepowo/bowawedixewuj.pdf
    • https://s3.amazonaws.com/ladojenefe/cambridge_preparation_for_the_toefl_ibt_test_4th_edition_free_download.pdf
    • https://s3.amazonaws.com/nemafu/biodigital_human_free.pdf
    • http://jibimom.myartsonline.com/bose_awr1-1w_antenna.pdf
    • http://romakilax.myartsonline.com/voxedumoweboj.pdf
    • https://s3.amazonaws.com/jokotaziweluge/49125198617.pdf
    • http://xipanizi.myartsonline.com/does_the_product_strictly_curls_work_on_straight_hair.pdf
    • https://s3.amazonaws.com/vidadaviwal/how_to_turn_a_into_a_powerpoint.pdf
    • https://s3.amazonaws.com/setigafat/pideget.pdf
    • https://s3.amazonaws.com/fosawef/maid_of_honour_sister_speech_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://s3.amazonaws.com/vid
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3e9.bin
e937e67bf61e069fe9b9dfe644d13c0aa2f9029960a8a043743dea11ce8d3c17		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3E9 5848 bytes
font_01_sfnt_off000107d3.bin
f66837c2c3f72175b9c2ca6c22c9366cef39760e7ca9d24f434dab92249ef0b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107D3 11132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.