Malicious PDF — malware analysis report

Static analysis result for SHA-256 125206590fd13a9b…

MALICIOUS

PDF

83.7 KB Created: 2021-07-14 09:22:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 6341bc9dbaeb63258863c41d248fd9b9 SHA-1: d1398af5ba0175458c2511d9ccea314092d0a3cc SHA-256: 125206590fd13a9ba1781101c778ae57e8572d3cfe49258e7b5b844384d26d8e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating it likely exploits a vulnerability or contains malicious content. The presence of embedded URLs suggests an attempt to redirect the user to a malicious site or download a secondary payload. The document body was unreadable, but the overall indicators point to a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8440

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/k6oGaauGqGM/square?utm_term=hydronephrosis+seen+in+kidney
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ede5dc017ec663b53d1f7f/1626203612530/81318168532.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e8e83b5fa2eb14b908c4d3/1625876539414/chaddy_bar_and_grill.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee0903a005482cc1521279/1626212611654/90193645190.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec8297c268f363b086a0ef/1626112664049/weight_watchers_points_plus_pedometer_manual.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec97081996685841aa5b3f/1626117896859/puvibexusup.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e81b5b86d8930991a8ec47/1625824091700/45974733401.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e702.bin
37d46dc21af6c1842612fff0076841b4afeb202c5eb9b38fd57f9aa559c5992e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE702 17120 bytes
font_01_sfnt_off0001136c.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1136C 16792 bytes
font_02_sfnt_off00012b83.bin
de83fde2f606641a60a95ea20e4a916965925c1baf30acb7d838d762742073ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B83 10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.