Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd699f7067e9a68d…

MALICIOUS

PDF

76.0 KB Created: 2021-03-18 15:45:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dee6c9a974691f40689dae16fc83970b SHA-1: 268a086c608cf6e03a2c412b82e394a96ce9a6e4 SHA-256: fd699f7067e9a68d6a878b33cfa92faad492f8146313c78c6eb1bb36509e4e32
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier with high confidence. It contains an embedded URL that redirects to a domain associated with malicious activity, and a heuristic indicates the presence of a download button lure. While no scripts were explicitly extracted, the PDF format can embed JavaScript, and the overall context suggests a phishing attempt to trick the user into downloading a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=personal+and+possessive+pronouns+exercises+online
    • http://mavidodi.iblogger.org/what_do_te_amo_mean.pdf
    • https://static.s123-cdn-static.com/uploads/4461232/normal_5ffc353adf948.pdf
    • http://sovaxalute.22web.org/roomba_400_error_codes.pdf
    • https://pukefigagarit.weebly.com/uploads/1/3/1/4/131406744/7713763.pdf
    • https://wikumegi.weebly.com/uploads/1/3/1/4/131407968/renogivivozu-zuwoverasifan.pdf
    • https://cdn-cms.f-static.net/uploads/4414860/normal_60411cf1ab7cf.pdf
    • https://wawodupalise.weebly.com/uploads/1/3/4/6/134621762/3ebf8.pdf
    • http://rexevivejegox.scienceontheweb.net/83973524323.pdf
    • http://tagaporigowekis.mygamesonline.org/ski_doo_repair_manual_free_download.pdf
    • http://bapatavusirave.mygamesonline.org/refiviwokupikom.pdf
    • https://rezigetofetima.weebly.com/uploads/1/3/1/1/131163738/a801b12866b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://goxafebo.myartsonline.com/abecedario_con_imagenes_para_colorear_e_imprimir.pdf
    • http://gumomexad.onlinewebshop.net/vekejaro.pdf
    • http://tonavisuma.onlinewebshop.net/wizasefifabusoposanek.pdf
    • https://uploads.strikinglycdn.com/files/4c562d72-c357-4197-8d21-099d5d76e578/la_catedral_del_mar_2.sezon_ne_zaman.pdf
    • http://pabewuvuxaf.onlinewebshop.net/47410312739.pdf
    • http://guvekes.rf.gd/adobe_reader_10_version.pdf
    • https://uploads.strikinglycdn.com/files/709b3be1-8197-4ec1-922b-55233aec2d89/52516277483.pdf
    • https://uploads.strikinglycdn.com/files/466724db-9d03-43ac-8bc9-887aad9c0667/kosopima.pdf
    • http://bijiwamosijiw.epizy.com/veggietales_theme_song_piano_sheet_music_free.pdf
    • https://uploads.strikinglycdn.com/files/cb3217d3-76b0-4220-8c83-d0cb8b4fdbc3/76869872397.pdf
    • http://fazegujopazoj.atwebpages.com/grammar_practice_activities.pdf
    • http://tanasebebibe.epizy.com/23810039176.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d57b.bin
fd7d2830e408d943d474df45ca18add8cb2f111acb26104db19d81b15a538ffd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD57B 5196 bytes
font_01_sfnt_off0000e73a.bin
1eca6c45191260b77b29e6b05cd416cb7d03635a80b7be18f2068687d8e3ff02		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE73A 10516 bytes
font_02_sfnt_off00010b70.bin
bb4620ae2308066493f479cb0495314a41e91f5b0bfb2a754d9bad2ef34af03d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B70 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.