Malicious PDF — malware analysis report

Static analysis result for SHA-256 21bb3595328203d4…

MALICIOUS

PDF

70.5 KB Created: 2021-03-17 05:41:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 352218d803a97b9993d18d7410419bf3 SHA-1: aaef41d3580d17ce89b802f6f58e2a68fe399db2 SHA-256: 21bb3595328203d4e36cdc307522852cb1e5e0bc64a5d03f0e7d9d39172e98bb
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF is flagged as malicious by ML classifiers and ClamAV, and contains multiple suspicious URLs. One heuristic specifically notes an image-heavy PDF with invisible links to a suspicious domain, suggesting a phishing or malware distribution lure. The document body, though heavily garbled, contains text related to a book download, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=employee+training+and+development+by+raymond+a+noe+7th+edition+pdf+free+download
    • http://ig-supportcenter.xyz/biotechnology_questions_and_answerssitoz.pdf
    • https://cdn-cms.f-static.net/uploads/4444657/normal_5fe84a5812115.pdf
    • https://cdn-cms.f-static.net/uploads/4455178/normal_603359d75813b.pdf
    • http://resezowuzotul.22web.org/bukibosowalefaloxeko.pdf
    • https://static.s123-cdn-static.com/uploads/4369908/normal_5fcad6c479dcb.pdf
    • http://kojenobowi.iblogger.org/acca_student_jobs_in_karachi.pdf
    • http://womixiwulaj.22web.org/what_is_religion_essay_brainly.pdf
    • https://cdn-cms.f-static.net/uploads/4457861/normal_601bc4c158c71.pdf
    • http://prod-fruit.space/asco_gu_2019_poster_guidelines5alal.pdf
    • https://cdn-cms.f-static.net/uploads/4380088/normal_604858724857a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c9dd1e16-2af6-4288-8439-1a6db6ccbb49/33398403848.pdf
    • https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_12407abe297745c6a35a90ffcfa3441f.pdf?index=true
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_61d7a5806011442c96f3a0eb1e7d1fa0.pdf?index=true
    • http://xepalufozakot.epizy.com/67625303280.pdf
    • http://sivopob.epizy.com/significado_de_alias_en_informatica.pdf
    • http://wofekasirirak.rf.gd/nazekagarufoxemogexa.pdf
    • http://zexelebisitod.epizy.com/skewness_and_kurtosis_lecture_notes.pdf
    • https://uploads.strikinglycdn.com/files/3886ffbd-b5e6-42b5-8ecc-317f19d066a4/solving_quadratic_equations_by_graphing_worksheet_with_answers.pdf
    • https://2ad55d82-15d9-4995-b72c-f03dca93b5f4.filesusr.com/ugd/11b7eb_259f12f30e754ba09e23a62be772eb76.pdf?index=true
    • http://lavuradisaxel.epizy.com/39723218196.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6f3.bin
a96d7ca1e3dd7a28d0e21e7a1b6f80252cc191cabccec53e23238c8368063b5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6F3 5708 bytes
font_01_sfnt_off0000ea55.bin
d8a0b4a9a8a4000abb4077cfd5e96786d0a7d9840f844e3e25a2fd1b75129d4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA55 9804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.