Malicious PDF — malware analysis report

Static analysis result for SHA-256 11b20dd3c7fb7090…

MALICIOUS

PDF

79.9 KB Created: 2021-03-15 22:22:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d353b4a4c8d6c2e9fd2f30193b41a86 SHA-1: b994cab896b038b7fa3ac0a36090b08983ba431b SHA-256: 11b20dd3c7fb709021dabd52009323aa2d1512b887ee17c4df333f352f24813f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is identified as a potential phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though truncated and obfuscated, suggests a pretext of providing an answer key to a webquest, likely to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=shakespeare+webquest+answer+key
    • http://tifoxikutawe.sportsontheweb.net/child_care_business_plan_executive_summary.pdf
    • https://static.s123-cdn-static.com/uploads/4393186/normal_5fded1ed471e9.pdf
    • https://cdn.sqhk.co/figesuweno/ic7urig/windows_10_pc_software.pdf
    • https://cdn-cms.f-static.net/uploads/4471252/normal_60306f62aa295.pdf
    • https://cdn-cms.f-static.net/uploads/4443619/normal_603f842aa5db5.pdf
    • http://fumexijana.getenjoyment.net/bissell_powerforce_compact_model_1520_belt.pdf
    • https://cdn.sqhk.co/jomububorava/Iftjahd/75372783299.pdf
    • https://static.s123-cdn-static.com/uploads/4475720/normal_60014997b3a9a.pdf
    • https://cdn-cms.f-static.net/uploads/4456982/normal_603b723f58bce.pdf
    • https://cdn.sqhk.co/pujixefan/iclmngg/dikinakadeg.pdf
    • http://tuvivukaroj.mygamesonline.org/realidades_2_capitulo_2b_vocabulary_check_sheet_1.pdf
    • https://cdn.sqhk.co/gudopokobipa/jhasijC/9144890055.pdf
    • https://cdn.sqhk.co/vafodagusun/chhgg0e/fire_boy_water_girl_ice_temple_y8.pdf
    • http://mavigawika.scienceontheweb.net/cuales_son_los_sintomas_de_embarazo_de_gemelos.pdf
    • http://roxelejabojafe.scienceontheweb.net/46467309517.pdf
    • https://static.s123-cdn-static.com/uploads/4485015/normal_6006bbee39d6e.pdf
    • https://cdn-cms.f-static.net/uploads/4393635/normal_60421918039a8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://67dc9804-4028-4298-afd7-d431d2c16fe6.filesusr.com/ugd/559c84_e94345006e154ac2989fdee123000a35.pdf?index=true
    • http://jisunopesaluzi.atwebpages.com/macbeth_play_shakespeare_globe.pdf
    • https://1eb42bdc-3da6-4b32-b75f-4382f1721f8e.filesusr.com/ugd/35474d_1eaa7729adbb4e08b4b693b461f0a18f.pdf?index=true
    • https://584dc5e1-4449-4bca-b3d9-d0e1fa08a972.filesusr.com/ugd/185caa_251a15697fe54673bb8e35c17a66460a.pdf?index=true
    • https://7605d98d-8b17-4a41-9383-f5c8d5af9bcc.filesusr.com/ugd/2bed4c_3ca1b6fba0e04e66a6faae4372e06100.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e662.bin
cc74990f8becf0bfd93a01c8485e5fbaa51e4795ac65482ee0388db1e177ae47		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE662 5504 bytes
font_01_sfnt_off0000f92a.bin
cbf871366cbce09366fbcdd72d2239616775b599bb60b1a29966eb5db662b18c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF92A 10264 bytes
font_02_sfnt_off00011c50.bin
541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C50 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.