Malicious PDF — malware analysis report

Static analysis result for SHA-256 03750c25d61e1d46…

MALICIOUS

PDF

79.5 KB Created: 2021-04-04 02:53:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b7d20c38885bcf72a6fd1f882fa53931 SHA-1: afd3779ca96b8c86b186a3e082bfe36961cd8da7 SHA-256: 03750c25d61e1d46acf0265b29c2c2b1217a7b7ab42970ef05415f313cfbe560
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'exploration student worksheet answers'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=exploration+student+worksheet+answers
    • https://cdn-cms.f-static.net/uploads/4454287/normal_604cc69c7a726.pdf
    • https://cdn.sqhk.co/maduzonuxoke/hjaMwB1/optavia_coach_answers_document_library.pdf
    • http://fakts.design/how_to_pass_the_qts_numeracy_and_literacy_skills_testsygi2h.pdf
    • https://static.s123-cdn-static.com/uploads/4452587/normal_5fcbaf0a7ad51.pdf
    • http://swiss-family.space/life_cycle_of_anthocerosbk4pr.pdf
    • http://recepty-dd.info/tabudafupipubumutik1c8r.pdf
    • http://blablablacar.online/bemesxxq0s.pdf
    • http://rating-bookmaker.ru/free_online_cooking_games_burger_shopk1i2x.pdf
    • https://cdn.sqhk.co/mizipudi/asrm7gi/rowetejede.pdf
    • http://megatorg.ru/11416134394qf17h.pdf
    • https://static.s123-cdn-static.com/uploads/4412591/normal_5fe4bf7dddffa.pdf
    • https://cdn-cms.f-static.net/uploads/4481271/normal_602ef41b0fcd7.pdf
    • http://winoorama.site/lisinupop7sfsi.pdf
    • https://cdn-cms.f-static.net/uploads/4490534/normal_600d8d158b796.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1094d5c0-a920-47c7-a1de-7e2d56a92d84.filesusr.com/ugd/47b1e8_fefeff03595e4357ab344b5298d07258.pdf?index=true
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_c67fe5e18e4242629c0eefe638d5a925.pdf?index=true
    • https://6cbe2f5c-748b-4bc6-b691-25a968a47885.filesusr.com/ugd/d6b5da_85e534d91a2f4256813380311d436aac.pdf?index=true
    • https://s3.amazonaws.com/bisegilupuf/subway_singapore_menu_price_2020.pdf
    • https://s3.amazonaws.com/fajeloninesitel/hillsborough_nj_high_school_football_schedule_2019.pdf
    • https://ad177677-9664-42cd-9bf2-17a10eef6e1d.filesusr.com/ugd/f8915e_f5cb699450f3449abc0c6488d4470357.pdf?index=true
    • https://s3.amazonaws.com/kiremefegonar/12623172546.pdf
    • https://s3.amazonaws.com/dakebesuvum/zondervan_bible_dictionary_marriage.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f92c.bin
f91fab8303981cc2d88c9cf1e5104a3e4fceefe3011172e78149899919c8c59d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF92C 5228 bytes
font_01_sfnt_off00010afd.bin
2dac4af1e7b867b9eae13f67ba74ed449ce63fb42cd7840a505da58f6df68668		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AFD 11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.