Malicious PDF — malware analysis report

Static analysis result for SHA-256 161ccded2c3df099…

MALICIOUS

PDF

68.1 KB Created: 2021-05-19 06:57:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1f76066f81e267be19eeb349a044063 SHA-1: d643b82215909c6c858d91501cf92ca5cbb9096a SHA-256: 161ccded2c3df09990ff0827f96c19e2734d5d8e6f269be396d7d8d3002b0728
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a machine learning classifier and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, which is likely used to deliver a malicious payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to 'Qcm immunologie pdf'. No scripts were extracted, but the presence of an external URI in a malicious PDF strongly suggests an attempt to redirect the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=qcm+immunologie+pdf
    • https://static.s123-cdn-static.com/uploads/4444356/normal_5ff087727ca71.pdf
    • https://static.s123-cdn-static.com/uploads/4476432/normal_5fca75f603799.pdf
    • https://static.s123-cdn-static.com/uploads/4467306/normal_6006cb68de81c.pdf
    • https://cdn-cms.f-static.net/uploads/4446019/normal_603bdb290d7d2.pdf
    • https://static.s123-cdn-static.com/uploads/4458833/normal_5fe5ac221778f.pdf
    • https://static.s123-cdn-static.com/uploads/4504870/normal_6002f1695e0e0.pdf
    • https://cdn-cms.f-static.net/uploads/4416802/normal_600c4973e230b.pdf
    • https://static.s123-cdn-static.com/uploads/4418000/normal_5fdfc251b8945.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/140bd68b-209f-4dd0-abe7-28d97d9ea158/95458527334.pdf
    • https://s3.amazonaws.com/gaxuremewuger/53330986527.pdf
    • https://s3.amazonaws.com/faduxodiwo/library_exam_questions_and_answers.pdf
    • https://s3.amazonaws.com/nezanurugega/touchpad_driver_for_windows_8._1_dell.pdf
    • https://uploads.strikinglycdn.com/files/4ff58937-821e-4847-a9b7-389045b22a4f/2000_gmc_sierra_wiring_diagram.pdf
    • https://uploads.strikinglycdn.com/files/59903230-e8fc-4639-8db8-21ddafc820bc/vocabulary_from_latin_and_greek_roots_unit_4_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/38b03df7-ef19-40a4-a302-9b9df5ea0b8d/balarusekuvamefus.pdf
    • https://uploads.strikinglycdn.com/files/588124fd-effc-4bb6-8e95-815189dbbe2a/75892221064.pdf
    • https://uploads.strikinglycdn.com/files/aeacdf44-c1b7-4b35-87b5-9c6ba665fbc2/webabusebimeturomuti.pdf
    • https://uploads.strikinglycdn.com/files/db39e903-0d9d-4e8e-8632-db0aecf87680/how_to_influence_others_and_make_friends.pdf
    • https://s3.amazonaws.com/wutisigila/how_long_is_final_fantasy_15_royal_edition.pdf
    • https://s3.amazonaws.com/gopuze/dizoxuxavovupebuxu.pdf
    • https://s3.amazonaws.com/xajowu/2936502922.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccb2.bin
5e3dfbda9692745b2ea98ee6bbdbd1c93dce9cd9d0d9b04368fa2daf91cc86db		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCCB2 5052 bytes
font_01_sfnt_off0000ddde.bin
6497c1022e593535b721df70585df44e47df875206c09e82e84905f49770b186		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDDE 11456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.