Malicious PDF — malware analysis report

Static analysis result for SHA-256 02d845f103e0fc46…

MALICIOUS

PDF

76.1 KB Created: 2021-07-13 18:32:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: e33e9a975f63bab499a3c56302bfe991 SHA-1: 94c18393a4816e7079de70c108f1df6b6efa0e04 SHA-256: 02d845f103e0fc463ce1ce6cb1434c5a292ca3f85b5129ab0495714a6106cea7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The embedded URLs, though some are marked benign, suggest an attempt to redirect the user to external resources. The file's structure and detection patterns are consistent with a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7746

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/y83TWYo-3DA/square?utm_term=free+download+to+pdf+to+word+converter
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e91a36b10b9b33fa978184/1625889334860/93956239204.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec98d77d354a5e86a4daff/1626118359431/converting_dgn_to_dwg.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ed4ff03489b768f16f3dc2/1626165232747/dabezakojojedi.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e92e80f107ff2467e98288/1625894528330/18413396546.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9b6.bin
bdfc2a8c96efa4e5b75e570c085c49ec20a2ace4a97c3e958496447c55e39846		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9B6 10484 bytes
font_01_sfnt_off0000e1b1.bin
2eba3a804eaed97e4f32c53f6deb0a0e0162d37391b2f64c56c04ec8ffdc09c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1B1 16396 bytes
font_02_sfnt_off00010c5f.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C5F 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.