Malicious PDF — malware analysis report

Static analysis result for SHA-256 14b2cf7b7c8a87af…

MALICIOUS

PDF

73.3 KB Created: 2021-07-14 07:57:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 557e62c77eea4669640c054b33aab5b4 SHA-1: 33136f38bacff2d2fee3b7221c4f50056950acf2 SHA-256: 14b2cf7b7c8a87af72aa3eb0e4d6f9ad87cf2c2083cb099136bddc7e87712b4a
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was identified as malicious by ClamAV with a signature indicating a phishing trojan. The PDF contains embedded URLs, one of which points to a Google feedproxy, and several other URLs that are part of the PDF metadata. The presence of duplicate object bodies suggests potential obfuscation or malformed structure, common in malicious PDFs. While no scripts were extracted, the overall structure and ClamAV verdict strongly suggest an attempt to exploit vulnerabilities or trick the user.

Machine Learning

  • Nyx PDF Classifier clean score 0.1869

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/IdU8rIDf9lQ/square?utm_term=pope+john+paul+ii+quotes+on+family
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60edcd04c450ee47307cebb6/1626197252573/44991671548.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee605677e2cd4113f22a0d/1626234966852/mewojikipipejit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bf6f.bin
ae9ac729aed93243dcca6c91dfebf19d3c19e9b7e9f69a10e7b5c55a5a2119ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBF6F 11012 bytes
font_01_sfnt_off0000d8df.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8DF 16792 bytes
font_02_sfnt_off0000f0f1.bin
c255a7df598e25eda7742b14d1e14f7f746a48bde32d4af840f7716a30e5dd72		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0F1 15728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.