Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f9e655b92225129…

MALICIOUS

PDF

77.7 KB Created: 2021-07-14 04:51:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: eef9a7c75bbb527b644ff31832b8e71c SHA-1: f86e142362ba73ddeb79b98e79d16ec898a58035 SHA-256: 0f9e655b92225129a4e6a0993f49caf6a50eaa198076f1c4ff2a3d7ec9a8e618
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The presence of embedded URLs, despite some being labeled as benign, suggests an attempt to lure the user to malicious content. The ML classifier also strongly indicated maliciousness. The file's structure and detection pattern align with common phishing techniques delivered via PDF attachments.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/kVSxLQpkboc/square?utm_term=commercial+gas+strength+test+pressure
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60eca5037b14134336dfde3d/1626121475450/wukujiwopapelamegib.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e91233cc7c086459264e8a/1625887283836/seven_nation_army_tutorial.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e7908f69e16759cf71772c/1625788559392/pork_chop_and_rice_casserole_with_cream_of_mushroom_soup.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e8c9f3e1e3555a32468f1f/1625868787082/side_bangs_for_round_face.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec708cc3fb560d26f0d6ff/1626108044968/10141966527.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edff3dcc8e436e4668daa9/1626210109444/millipedes_in_plants.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60eddd53ad58ca03d226b4f3/1626201427909/85875890703.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e9094a92abcc18c4f5014b/1625885002866/dimensions_of_tourism.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e84b948d23a90293b1dfd6/1625836436187/customer_centered_selling.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e94b0892abcc18c4f76309/1625901832558/great_companies_to_work_for.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee383702e0767984f31b14/1626224695139/rofugajosajedumesideluxak.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd33.bin
471b83e6e0aa2c46a1a03c1f62ac37391b8ea60bdb647ae4d09895651aa814c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD33 10952 bytes
font_01_sfnt_off0000e662.bin
9da77c190cce76d567f7603ffe300e93b9abe1c9c1910ed9eba648831937ee90		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE662 16732 bytes
font_02_sfnt_off00011240.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11240 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.