Malicious PDF — malware analysis report

Static analysis result for SHA-256 02d9b95b28275ec6…

MALICIOUS

PDF

76.3 KB Created: 2021-03-25 14:47:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af0e82a05cc2d3ea72ee667a0c136b54 SHA-1: b0dbef0ed93900c5985ee2734fb8029f903e88c4 SHA-256: 02d9b95b28275ec695a18dc7f71d2d6c954d65f5738ab86f04881fe3212cc2d8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a malicious domain, likely intended to trick the user into downloading further malware or visiting a phishing site. ClamAV and ML classifiers strongly indicate maliciousness, and the PDF structure includes external URI references consistent with phishing or malware distribution. The document body, though heavily obfuscated, contains text related to educational materials, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=linear+quadratic+systems+worksheet+kuta
    • http://meriline.store/chess_rush_positioning_guide70h1l.pdf
    • http://nuverlites.online/the_creature_from_jekyll_island_espaol4s9uk.pdf
    • http://discount50it.pro/when_is_the_next_prime_minister_announcement_on_lockdownkfbcw.pdf
    • http://lidzadva.xyz/galujpy30q.pdf
    • http://setifol.66ghz.com/tatil.pdf
    • http://5coupon.info/63181926350weij2.pdf
    • https://cdn.sqhk.co/ferorigife/gibifsF/ara_pacis_art.pdf
    • http://greatholl.com/8525423158769gb2.pdf
    • https://wefigoga.weebly.com/uploads/1/3/4/0/134041661/mixarepovenenep.pdf
    • https://joxedobiwot.weebly.com/uploads/1/3/5/3/135350216/d67ab35d99c1a.pdf
    • http://meblik.su/xiwuxadaloroguxalujeee8yr.pdf
    • https://gotanizanoga.weebly.com/uploads/1/3/5/3/135332446/9926653.pdf
    • http://sellamorem.com/jalarakarapipowatezudewkwvjq.pdf
    • http://reduslim-italiaofficial.site/giponumaluvupazigifofakicv9r7.pdf
    • https://cdn.sqhk.co/pazakazagoz/BD9ricr/world_of_kings_berserker_guide_deutsch.pdf
    • https://fumuzuwuwuwupu.weebly.com/uploads/1/3/0/9/130969925/ridowud-pezol-mumus-biwusoxedo.pdf
    • http://justiciaforjustice.com/novufosilamekee3g1b.pdf
    • http://soldatskaya6.ru/garmin_oregon_700_vs_gpsmap_64sxy7l7c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kukadafimi.rf.gd/best_naruto_shippuden_game_for_android.pdf
    • http://salulasalanegox.rf.gd/usability_heuristic_evaluation_report.pdf
    • http://mufigodukusa.epizy.com/cooking_leveling_guide_bdo.pdf
    • http://gurunetotej.rf.gd/51925118933.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec6f.bin
1a429cccc2e35ed46a74e2056c6cb6346c18b2b3d89f525b21353f208ec7c137
pdf-font-stream PDF embedded font (sfnt) at offset 0xEC6F 5472 bytes
font_01_sfnt_off0000fefa.bin
709214759bacd1b72e87ea92ee4a86212ad2dc032a71bd2abcfc8080c410de37
pdf-font-stream PDF embedded font (sfnt) at offset 0xFEFA 10860 bytes