Malicious PDF — malware analysis report

Static analysis result for SHA-256 27b3d0027d7d1e73…

MALICIOUS

PDF

99.6 KB Created: 2021-07-18 16:17:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: c8b568fcab4320a38bb440cb1632f4f9 SHA-1: 19c4eaf5786741094bab92b70f9ae41b4fc2ef30 SHA-256: 27b3d0027d7d1e73b21ba0c6ad1253d15b1dc461ca7e0f5c2472ad8ce36fea8a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by multiple heuristics, including a high-confidence ML classifier and ClamAV. It contains embedded URLs that point to external resources, suggesting it is used to redirect users to potentially harmful websites. The presence of PDF-specific heuristics indicates it exploits PDF features for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/gPkW7oTCsL0/square?utm_term=after+effects+cinematic+intro+template+free+download PDF link annotation
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e7ce62dbc52028c83eea56/1625804386566/kavaf.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f1ab9c10b8dc7fbbaec5ba/1626450845564/i2c_interfacing_with_pic_microcontroller.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee70a18e3fff2bd3c384a6/1626239137672/32118329429.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60eff47b874a183f1c400898/1626338427708/collection_of_short_stories.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee4d7a2d09e34b72a14690/1626230138490/fejibumisemalaxopikew.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e906a02210ba6bce11282f/1625884320378/inter_second_year_physics_important_questions_with_answers.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec8cd6c426b81e830096bb/1626115286680/41221513337.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f3d9bb6f491d4a1ff6dd20/1626593723413/20971476511.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f0026e874a183f1c409c43/1626341999060/principles_of_measurement_systems_bentley_solutions.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60eda6f9834e745de9d17b81/1626187514109/26464357101.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000120b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120B8 10848 bytes
SHA-256: 2a3f531b5a64421c418e76b382fdf869b30ccfaa53ed8dc797bcd32069c757f9
font_01_sfnt_off000139d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x139D2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000151e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x151E4 17564 bytes
SHA-256: 9f644705d386cc4b2fbef8df1f6f87a785104621ea41324193e27a227b33fea1

Open this report in the interactive analyzer, or submit your own file for analysis.