Malicious PDF — malware analysis report

Static analysis result for SHA-256 020335c2ef214b18…

MALICIOUS

PDF

80.5 KB Created: 2021-04-10 07:32:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 213bd3589d8388fb22a8db913aa1eb8f SHA-1: 1140a45dfd77f754c340f4f644026ad12f1c0ed1 SHA-256: 020335c2ef214b186b3ea3289c9e628788c0d4d10ad8b7d1822a99e1ff65a7d3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search result, likely to trick users into visiting a malicious site. No scripts were extracted, but the presence of external URIs and the ML/AV detections strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=singapore+math+reviews+negative PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369191/normal_6069f60b24b12.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465548/normal_602d7f10239fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459035/normal_60414c5f06eda.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465690/normal_602102c5d0b44.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408002/normal_5feb476a56950.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463298/normal_600dc68319fce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447079/normal_60180ba32c5a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459477/normal_60115f987fbc1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/padosumifubobo/tibuliw.pdfIn PDF document text
    • https://s3.amazonaws.com/jenisozazewubo/gixutit.pdfIn PDF document text
    • https://s3.amazonaws.com/rizijubovapuk/singer_328k_price.pdfIn PDF document text
    • https://s3.amazonaws.com/sedimeraxufi/photo_background_remover_app_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db7a16b7-5b3b-491b-af99-2f551f3066e5/community_service_for_delta_sigma_theta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02cae0bb-fca0-42fb-bbe8-752cd16253db/what_are_the_techniques_of_curriculum_evaluation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f066ad9-c57a-42c9-b67d-0078f687b2d4/40828766596.pdfIn PDF document text
    • https://s3.amazonaws.com/jopomodilamego/73540370861.pdfIn PDF document text
    • https://s3.amazonaws.com/fedure/56026712993.pdfIn PDF document text
    • https://s3.amazonaws.com/safago/ecocardiograma_estres_dobutamina.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef744dc5-3987-467b-8830-b4eb7fc1c34c/92444118209.pdfIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/brand_guidelines_template_powerpoint.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bb13479-692d-4050-9725-90f67102a3e5/gepik.pdfIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/10427832041.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a32edf6-1f09-4e09-85b1-f287789040f5/machine_learning_engineer_jobs_melbourne.pdfIn PDF document text
    • https://s3.amazonaws.com/waxegatulo/suposisumimufaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83aa660c-9ced-48c5-b6d4-caf549294f22/english_grammar_learn_online.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE29 5244 bytes
SHA-256: 2162fdc4450d315aa485728087c209c7543ab6a2da42c90c79b4239e9da6a6e0
font_01_sfnt_off0000ffd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFD5 11740 bytes
SHA-256: 2a1d54269853e2f0522b12ceda89333a004f831a76f7bd223a463811b8e02d1e
font_02_sfnt_off0001263b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1263B 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.