Malicious PDF — malware analysis report

Static analysis result for SHA-256 26182981d5620401…

MALICIOUS

PDF

85.2 KB Created: 2021-03-20 07:05:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ef1af09a3fae876bbd796ec51a365db SHA-1: b420329e120a6830182d1c829ee641b671b6ccb0 SHA-256: 26182981d562040159dbbe05602e568e509b70e222f6ab56f6017a1ab3d48f7e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by ML classifiers and ClamAV as malicious. The document body, though heavily obfuscated, suggests a lure related to educational content. The primary IOC is the external URI which likely leads to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=character+profile+worksheet+for+students
    • https://cdn.sqhk.co/nilesatu/Kgevuhb/viwofasonedizosa.pdf
    • http://wosozage.mypressonline.com/best_diy_shooting_sticks.pdf
    • https://cdn.sqhk.co/vexerofexe/bPiidA7/autocad_2020_manual.pdf
    • http://busimaderule.mywebcommunity.org/jivizanawe.pdf
    • http://robugipunebib.mygamesonline.org/rokitenuvax.pdf
    • http://pemizirevubel.mywebcommunity.org/45126626572.pdf
    • https://cdn.sqhk.co/lajojeletab/eJ0hjia/how_to_get_super_hexagon_for_free_ios.pdf
    • http://dotekebenutedex.scienceontheweb.net/trumpet_articulation_exercises.pdf
    • https://cdn.sqhk.co/moserusoba/ApxSwhg/58734699516.pdf
    • https://cdn.sqhk.co/jesisuvov/bLIAsjg/hd_tumblr_wallpaper_for_laptop_full_screen.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://womawujun.atwebpages.com/psychic_intelligence_book.pdf
    • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_22f179ea382c45f7809e5a49545b5c74.pdf?index=true
    • https://7afd96e6-4611-46d4-9b98-d111b897c281.filesusr.com/ugd/154221_8b05cdd2b7d34d08a742e34c503189f2.pdf?index=true
    • https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_7bcfd7b059254f4aaa890055f8f6d0ed.pdf?index=true
    • http://foxukekamusun.onlinewebshop.net/react_native_mobile_app_tutorial_for_beginners.pdf
    • https://3c1efe6f-6e34-41bb-a2c4-2be85dd3cb33.filesusr.com/ugd/41f880_8559985aee7d4f39966efe1f78783572.pdf?index=true
    • https://8641c524-1fb5-4292-87ed-dd72f64d6c22.filesusr.com/ugd/9b7d8a_1c873d53f19f4c9ab566cccf5913ee82.pdf?index=true
    • https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_afb814da103345a7b1d33801d8ab3363.pdf?index=true
    • http://rewuwuja.onlinewebshop.net/rolemaster_character_law_and_campaign_law.pdf
    • http://fowimifefezujo.myartsonline.com/2006_bmw_330i_starter_problems.pdf
    • http://gozuketitara.onlinewebshop.net/attention_lyrics_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa49.bin
2aaf7420040af37f2f80715f0cf25523f641df300f090eda259a4d204c3fcd83		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA49 5304 bytes
font_01_sfnt_off00010c5a.bin
cca77142bf9540b7d47133cfdb147d7a382ddc991d3eb11bf935a48688797b4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C5A 11072 bytes
font_02_sfnt_off0001324d.bin
c9557d91917e40dbb2ce09b7ef560a04a9a832ffe2ebcac6b50408a58351272e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1324D 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.