Malicious PDF — malware analysis report

Static analysis result for SHA-256 18b6d8c62d23325d…

MALICIOUS

PDF

82.8 KB Created: 2021-05-28 07:52:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 067b0afa98bdce6d4b841a2ac7f2fb16 SHA-1: 7e21f1adb7dd50bf5e2e3cda532e777e12b345eb SHA-256: 18b6d8c62d23325d074789f9c1ab6b4fb0e97955c9db929633e8303e01ffea3f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL that, when visited, likely serves a malicious payload or redirects to a phishing site. The document body, though heavily obfuscated, suggests a lure related to educational content, which is a common tactic for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wb?keyword=cual%20es%20la%20estructura%20de%20un%20texto%20narrativo%20para%20ni%C3%B1os PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4448096/normal_5fd0ac7a3fb6f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474988/normal_601ced7254f3e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386361/normal_5ffc1a1b2ba8c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457876/normal_5ff3151394f78.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373240/normal_5ff1164cd4dae.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373509/normal_5ff68f7a161a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445866/normal_5fe7ec6358c06.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4492575/normal_60526054e36fd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393016/normal_5ffea68ddb789.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490523/normal_601d4c263097e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445558/normal_6037ff21edbf6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425784/normal_6061c70db1b4a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387816/normal_601ecc6264dcb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463266/normal_604908e199d6b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/40456a77-a5b3-4eae-bb3c-6a3b5094bd08/zetidiraso.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0a57582-a710-4684-80e8-013deabcefda/panasonic_uk_helpline.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c89a235-3394-4a42-9977-ffe6a7126927/84072632971.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12efa09f-31c3-4470-82cc-d975d7f08d66/what_are_the_rules_of_billiards.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4e60fb4-2b49-44f3-ae79-c14c38296338/bhagavad_gita_chapter_12_audio_chinmaya_mission.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86874515-0866-4149-acd4-e34f55b9b554/gilatojunuxavoxaga.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBED 5312 bytes
SHA-256: 9c1236ddf2260315b242ae53507fb66b80b619cbb44f8ed1d1bd4cb0906ad3b2
font_01_sfnt_off0000fdcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDCD 12252 bytes
SHA-256: 66c198a4d57c4f975dae9b79eaee897cdd0c7d03df440db11c6b69400b48a717
font_02_sfnt_off000125e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125E6 16124 bytes
SHA-256: 8526dfdaf9b8d62c51faf03373666e2c64285d8597a587e409a881ae6feb351c

Open this report in the interactive analyzer, or submit your own file for analysis.