Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe7b05f215e30d77…

MALICIOUS

PDF

80.7 KB Created: 2021-03-24 08:54:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ed2e5b1a92ff408d818c644d537eb163 SHA-1: efab475ba8a772043cae1daa3b9fb16ec47a4598 SHA-256: fe7b05f215e30d77706d0b0f1667524be19f732427d23189bd4cc7d896b89174
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL and has been flagged by a machine learning classifier and ClamAV as malicious. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may be instructing the user to open a password-protected archive, a common tactic for evading gateway security. The presence of an external URI and the ML/ClamAV detections indicate a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=radical+candor+pdf+espa%25C3%25B1ol
    • http://balifruit.com/super_mario_bros_2_nes_emulator_cheat_codesexavs.pdf
    • http://urro-hu.com/best_video_games_2018_androidcvfei.pdf
    • http://dietnatur.fun/android_studio_gradle_plugin_updatezlem3.pdf
    • https://jaxanawunolat.weebly.com/uploads/1/3/0/7/130739567/vovugasekub-lejowiwigok-rekovigipeb-kuwun.pdf
    • https://wanesutilujat.weebly.com/uploads/1/3/4/8/134868149/jirezinataso_tijimagodeluf_ziduz.pdf
    • http://arfesopt.com/mhw_insect_glaive_guide7h8if.pdf
    • https://jitipukojid.weebly.com/uploads/1/3/4/7/134707402/ginatadedafadu-pelenabifen.pdf
    • http://hurleyshamburgers.com/libro_la_iliada_para_niosqzpu3.pdf
    • http://wipababotuzuke.iblogger.org/parental_care_in_insects.pdf
    • http://sujegudapapew.iblogger.org/67004587163.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/toliwudalamem/whats_the_healthiest_breakfast_sandwich_to_eat.pdf
    • http://tuxusar.epizy.com/final_fantasy_xv_review_2020.pdf
    • https://1c019786-7048-4615-837a-ae53f087c4ae.filesusr.com/ugd/8b4172_27fbc5c2fd244e9f8d482b44ae0bb3c3.pdf?index=true
    • https://s3.amazonaws.com/jiwisigetizoxif/crecimiento_bacteriano_microbiologia.pdf
    • https://964beff5-d24f-450a-94e2-fa7e9faef44a.filesusr.com/ugd/61158f_50dbdbbbf79f4ca3ba9bffb2d2f6d5ab.pdf?index=true
    • https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_81c4ae37bdd04629873568d278a5b01d.pdf?index=true
    • https://s3.amazonaws.com/kisimujuk/52460329887.pdf
    • http://redotikami.rf.gd/bulbul_new_song_2018.pdf
    • https://s3.amazonaws.com/zedudo/zadojesodexubenu.pdf
    • http://vekoxoke.epizy.com/26042392219.pdf
    • https://s3.amazonaws.com/nuxomigo/top_notch_fundamentals_teachers_book.pdf
    • https://528f6e5c-6927-42ef-b7a5-a8f9c349750c.filesusr.com/ugd/07b979_0ad7faa7ae344938a5238411f7571d30.pdf?index=true
    • https://c301b42c-deab-4116-afcd-a09dd0728425.filesusr.com/ugd/4bb894_b8f07eeb9d9b47d39e44747e004408da.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb2c.bin
5623eab57f186822742dc2cdfafee09a1bc08ccb15eb0eb2dfca34b92c6c0567		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB2C 5368 bytes
font_01_sfnt_off00010d40.bin
4dbdf0edf84c813e4842509634798a8f0ea048e850767705ae3a03988017f677		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D40 11848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.