Malicious PDF — malware analysis report

Static analysis result for SHA-256 26abdffb27008a5b…

MALICIOUS

PDF

115.9 KB Created: 2021-03-14 12:50:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 490940235b53ebf97e545155cfafb5fe SHA-1: 731ae0f5933cd0d8445d4a4bf8dfc0bdcb02841d SHA-256: 26abdffb27008a5b153fbe797b86c2a0769386c72a9d8c53f6f8e89374a265dd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to search queries, and an external URI points to a URL that mimics a search result for "Self efficacy albert bandura pdf". This suggests a phishing lure designed to trick users into clicking the link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=self+efficacy+albert+bandura+pdf
    • https://static.s123-cdn-static.com/uploads/4421641/normal_6003d5f373cc6.pdf
    • https://cdn-cms.f-static.net/uploads/4424682/normal_604d6fc6e3184.pdf
    • http://sigisuzuk.getenjoyment.net/how_to_do_a_manual_network_selection_iphone.pdf
    • https://static.s123-cdn-static.com/uploads/4488581/normal_5fffe2114f585.pdf
    • http://rosutob.getenjoyment.net/how_to_use_run_on_sentence.pdf
    • http://mowefopovog.mywebcommunity.org/audio-technica_at-lp60xbt_bluetooth_fully_automatic_stereo_turntable.pdf
    • http://jofufuzutaki.22web.org/beiimaan_love_full_movie_free_mp4.pdf
    • https://cdn-cms.f-static.net/uploads/4489834/normal_5fd29f2f60994.pdf
    • https://static.s123-cdn-static.com/uploads/4425238/normal_5fcb3d4e9c95a.pdf
    • http://bioforce-co.site/how_to_write_a_thesis_for_a_compare_and_contrast_essaytazlj.pdf
    • http://sakulog.sportsontheweb.net/xomefafavadadukemebepana.pdf
    • http://azakalaza3.xyz/figotufejcsl6.pdf
    • http://gedagefi.22web.org/how_to_divide_decimal_numbers_by_1000.pdf
    • http://komakukamuduwi.iblogger.org/how_to_cure_plantar_fasciitis_and_heel_spur.pdf
    • http://setopin.mypressonline.com/what_does_coronary_artery_stenosis_mean.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ef4b221f-cfb4-47e8-bf1d-3b5092770df7.filesusr.com/ugd/4948da_b05a0ace8018407d94872fb4f12c7e4d.pdf?index=true
    • https://s3.amazonaws.com/tudawufed/xadejuraropezemesi.pdf
    • http://lomekezuki.rf.gd/wubaju.pdf
    • https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_50f8ecc154bb4ba1846594188d458ae8.pdf?index=true
    • https://2dc0326d-ac60-47d8-bf46-f2dc9d334570.filesusr.com/ugd/21b4a7_c64d8b36f7544ffebbd669c5e3150690.pdf?index=true
    • https://s3.amazonaws.com/pezofut/1277038396.pdf
    • https://12350a4d-732a-4148-85a7-4fa27f2a77ec.filesusr.com/ugd/17beed_14fb39da6250437385d8b1a6e708649e.pdf?index=true
    • https://s3.amazonaws.com/bufexa/sazajipemil.pdf
    • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_a31d30ffc3234a9690f72282ec98aa24.pdf?index=true
    • https://s3.amazonaws.com/wutezigojuxi/believer_tamil_lyrics_song.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017392.bin
bc9a8c8e5098243b7f3d4e799da2f6ad3e4a65563fc72c93d271915715aea5d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17392 5316 bytes
font_01_sfnt_off000185bd.bin
8feea716e350dd2f7083f428547ef5e0c36b6ea8b9ec69739a049b074a131df4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x185BD 11664 bytes
font_02_sfnt_off0001aca3.bin
5b0d2701ab39d2f69c66d7d16c60d8db0b323aa0832947137e757b5401d27330		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1ACA3 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.