Malicious PDF — malware analysis report

Static analysis result for SHA-256 0382a35083314c56…

MALICIOUS

PDF

83.3 KB Created: 2021-04-03 19:06:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7a804a694cfc9d14d8209f122cdff444 SHA-1: 749219f2da3cec5a0edaf655329dbb6438f79449 SHA-256: 0382a35083314c561242df044bcdf7b716519f21409cc2eea44fdb576afc39d4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely for phishing or malware distribution. ClamAV detection and ML classification strongly indicate malicious intent. The document body, though heavily obfuscated, contains text related to a physics guide review, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=basic+physics+a+self-teaching+guide+review
    • http://123dutch.com/kuvadorarodetabitezaxewewjoiwh.pdf
    • http://bred-enligne.com/2017_chevy_malibu_maintenance_schedule30l0t.pdf
    • http://organicnu.info/perfect_cutting_barber_shop6re9b.pdf
    • http://lozhobelir.space/35957486739gtoef.pdf
    • http://japavizifovot.22web.org/poligubanatejid.pdf
    • http://supsun-aero.com/69824978898wjdxs.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/kulinisokakewi/yahoo_answer_wiki.pdf
    • https://uploads.strikinglycdn.com/files/d7eaf8ae-282b-4086-9775-808fe032c397/parrot_ck3100_software_update_download.pdf
    • https://s3.amazonaws.com/jevedijadiki/tamil_news_paper_daily_thanthi.pdf
    • https://uploads.strikinglycdn.com/files/a4796bb7-922b-4297-a031-26cf2b5c827b/regoxikopelelibovog.pdf
    • https://uploads.strikinglycdn.com/files/f4d07fc3-de41-4dc8-b2ae-dcac3f63d6b8/31717847340.pdf
    • https://s3.amazonaws.com/setikizo/35150244125.pdf
    • http://purevaxa.epizy.com/tobazuwoxuva.pdf
    • https://uploads.strikinglycdn.com/files/01e3a3ef-1818-464e-baee-8e9bfe10b2cd/69613188735.pdf
    • https://uploads.strikinglycdn.com/files/ea9ccace-0fa3-4ad7-bc12-11974040e269/bizofuditebexulenafagure.pdf
    • https://s3.amazonaws.com/wanalovum/o_que_significa_uniformemente_variado.pdf
    • https://uploads.strikinglycdn.com/files/4c73ddc4-3e5a-4bfe-9193-82d7a873fedc/what_does_the_nichq_vanderbilt_assessment_scale_measure.pdf
    • https://uploads.strikinglycdn.com/files/d64ffc40-f357-4eb3-8110-9157bb8a06ad/mumovubajopodox.pdf
    • https://uploads.strikinglycdn.com/files/a135f14c-2987-4906-b4e5-9a9265849a6e/95286240072.pdf
    • https://uploads.strikinglycdn.com/files/09a25964-4385-433b-a2cf-5e99ef01392c/coleman_roadtrip_grill_accessory_stove_grate.pdf
    • https://s3.amazonaws.com/xakajoziwibi/84404072978.pdf
    • https://uploads.strikinglycdn.com/files/e46a62ca-7f3d-4406-957f-69f11e7cf93c/magij.pdf
    • http://fikikozazilut.rf.gd/pusutiritorizazivukotojez.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7aa.bin
798e63a1c8290c6172ae03673119cef8e33a1b6623aad323aa2caab3fd6a2836		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7AA 5524 bytes
font_01_sfnt_off00010a80.bin
6bd400b890d5b6eea3d73700e0935dc977900c62f662d1bb8698da988e7714cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A80 10820 bytes
font_02_sfnt_off00012fab.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FAB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.