Malicious PDF — malware analysis report

Static analysis result for SHA-256 0acce0268ea09499…

MALICIOUS

PDF

73.7 KB Created: 2021-03-08 09:17:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cd63c6a81e44756fe2ca3d97f2afe233 SHA-1: 7ba946a8ec3e2a6677f517d2120e0ad88ea21e9f SHA-256: 0acce0268ea094997e9f93baac0deed878465c2c848daee6cefbd015c4ad7ef6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to educational content, likely to trick users into clicking the malicious link. No scripts were extracted, but the presence of external URIs and the overall classification indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=average+atomic+mass+worksheet+answers+with+work
    • http://wekeb.space/duwirndgb8.pdf
    • http://fadulifakibul.medianewsonline.com/statistics_and_data_analysis_from_elementary_to_intermediate_tamhane.pdf
    • https://cdn-cms.f-static.net/uploads/4404727/normal_5fd83c0c24bee.pdf
    • https://cdn-cms.f-static.net/uploads/4408712/normal_601d66e83b554.pdf
    • http://dojemop.mywebcommunity.org/sophocles_ajax_greek.pdf
    • http://kuvezowepo.scienceontheweb.net/lakshmi_ashtothram_lyrics_in_english_with_meaning.pdf
    • https://cdn-cms.f-static.net/uploads/4475741/normal_602b8509d2160.pdf
    • https://static.s123-cdn-static.com/uploads/4468836/normal_5fe5d1863ebc8.pdf
    • http://fuxuxixigu.scienceontheweb.net/49790295237.pdf
    • https://cdn-cms.f-static.net/uploads/4450247/normal_603562e89276c.pdf
    • http://ruxuzosok.mywebcommunity.org/what_is_critical_illness_insurance_with_aflac.pdf
    • http://beamorem.com/nudidojoximekizevokifafox0nnif.pdf
    • http://tumbaa.space/beach_blanket_bingo_party_themez2m1s.pdf
    • http://instapriz.online/868745165540z5kh.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gofilafixu/bofebasokifux.pdf
    • https://s3.amazonaws.com/jolituzoji/metodologia_abp_aprendizaje_basado_en_proyectos.pdf
    • https://s3.amazonaws.com/piwupevivotixi/11241692770.pdf
    • https://uploads.strikinglycdn.com/files/1d47c1d5-6c11-4955-acb6-52e4d31d6fe8/sony_hdr-as200v_firmware_update.pdf
    • https://uploads.strikinglycdn.com/files/87ba09fa-0375-49b5-8474-4959e4a5b7ee/bapufisizat.pdf
    • https://uploads.strikinglycdn.com/files/6c4860f8-823c-4845-a7ad-ed6cc04b981d/butageworovifunudipili.pdf
    • https://s3.amazonaws.com/zufaxepixiguxax/48877432157.pdf
    • https://s3.amazonaws.com/biwubeleba/bapivarorifegesafitamu.pdf
    • https://uploads.strikinglycdn.com/files/dafb60d1-a9df-403d-a981-d89c4ce1b689/82672418738.pdf
    • https://s3.amazonaws.com/donarepemi/latarejejejemomijide.pdf
    • https://s3.amazonaws.com/tanikanaw/latulukikinonupada.pdf
    • https://s3.amazonaws.com/xapota/skf_chevin_light_font.pdf
    • https://s3.amazonaws.com/fosawef/bella_casa_rainbow_double_bed_sheet.pdf
    • https://s3.amazonaws.com/ninazarila/vans_black_authentic_platform_2._0_trainers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e12e.bin
7369e35c019f92136c9991918037fc3c6bc09e318e0039221e0bc3fece7ab119		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE12E 5388 bytes
font_01_sfnt_off0000f36f.bin
ddc52f828334f26559dae74bd73335c00752badac5ce9003ab90309ba8d427aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF36F 10780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.