Malicious PDF — malware analysis report

Static analysis result for SHA-256 14a3f654863f4391…

MALICIOUS

PDF

89.5 KB Created: 2021-07-22 22:14:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 37e3fc296b741892367d07b3584b3931 SHA-1: 668386106453ff6a298361b38e022ae99afde434 SHA-256: 14a3f654863f43918b65d03b2069b310378575f4b641f38d4ba8c5c5b2b240a2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing attempt. The PDF contains embedded URLs that likely lead to malicious content or further stages of an attack. The presence of embedded URLs and the overall detection by security tools suggest this file is part of a phishing campaign, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/UkUWPC8UKDU/square?utm_term=datatable+sort+by+column
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f05547c872e80de5b257f5/1626363208102/epilepsy_and_drivers_license.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ecb80d9c6b0e71d6d91c15/1626126349652/57438628183.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f3987cc5d9e6782ce4d9cb/1626577020742/kuxakaravasowuzikumi.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f6db25fb835906bd242b02/1626790693570/list_of_title_insurance_underwriters.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f88877bdebec6c3259a254/1626900599370/throw_a_monkey_in_the_wrench.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f1b869f55c957d6db34cc1/1626454121579/headache_only_on_left_side.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f747bd3b9f22122a50934a/1626818493308/digug.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f073786a22b22fd8a48691/1626370937133/james_brown_santa_claus_goes_straight_to_the_ghetto.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f7d421ab09506512d884fa/1626854433663/objection_handling_questions.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f365c381f38b205887f2d1/1626564035715/19080295080.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f4f9dd1d350707423296a8/1626667485523/15148441986.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f1846fb348e55d1c5576af/1626440815404/megutulowikoziro.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f3e6ebc4d0d61e673e319d/1626597099105/loa_love_success_stories.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee27ec2485902f3e71eb64/1626220524891/genuti.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60effe52a26b2b69a35d3387/1626340947018/booz_consulting_firm.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f46df9a047b636123003a4/1626631674015/kopufemiwixebutaji.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f773d31123550d45556988/1626829779842/42349226749.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ee7541df3d323292d3c8b7/1626240321986/postgres_create_table_with_foreign_key.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e81e494b964f05b84ab3a6/1625824842120/never_at_rest_a_biography_of_isaac_newton.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f92a3bd70c9108662100c1/1626942011656/4702741088.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f847.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF847 16792 bytes
font_01_sfnt_off0001105e.bin
df80d57932f9f88b426075f45f931499d837f3855ad5381731ccedb10d05b0c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1105E 10656 bytes
font_02_sfnt_off000128e6.bin
2bda8471446e5e34643c461b52635efba2f3b91d88a5332e7d0d3d096dc6af8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128E6 17876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.