Malicious PDF — malware analysis report

Static analysis result for SHA-256 297f89b6ff56f9ce…

MALICIOUS

PDF

84.6 KB Created: 2021-04-03 23:48:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1087225b30a09141307d7af5f7641e52 SHA-1: 7a24ca7a0d5728a0b9efb29f61a7d3a096ebaad5 SHA-256: 297f89b6ff56f9ced22ab218c8488e5fc45266dd65df22c2a6c710d9123c3e5f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware download site. The document body, though heavily obfuscated, suggests a lure related to educational material, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=lesson+2+the+rise+of+dictatorial+regimes+answers
    • https://cdn.sqhk.co/nonobepimaf/iU9icjg/70182658957.pdf
    • http://itabody.space/35777796470a8kjz.pdf
    • http://gakmancreatures.ru/lojudetupebox5mrp.pdf
    • https://cdn.sqhk.co/tobamozusaj/biiejjo/ncert_9th_class_science_book_solutions_chapter_9.pdf
    • https://cdn.sqhk.co/lofesaxudiwo/fBlYVJm/mokotisewetun.pdf
    • https://static.s123-cdn-static.com/uploads/4463824/normal_5fcbf8c63695f.pdf
    • https://cdn.sqhk.co/fobusobapeji/hvuhhhf/16745854983.pdf
    • https://cdn.sqhk.co/zuxafopagad/egerjex/bofa_prepaid_mobile_apk.pdf
    • https://cdn.sqhk.co/kegimovotol/hbrgggb/30815245245.pdf
    • https://cdn.sqhk.co/vibisimak/cgdhanO/zexikufatolipuv.pdf
    • https://cdn.sqhk.co/litonesi/jdgec3v/light_it_up_marshmello_instrumental.pdf
    • https://cdn.sqhk.co/kisesawaropo/bOhcRzU/calculator_hide_photo_video_apk.pdf
    • https://cdn.sqhk.co/gidenateg/evhjEjj/nugetepelasuda.pdf
    • https://cdn.sqhk.co/tatidukigag/hZc2icM/record_skype_video_calls_android_phone.pdf
    • https://cdn-cms.f-static.net/uploads/4393883/normal_603503b627017.pdf
    • https://cdn.sqhk.co/rexadiwixox/egcIQgc/sonic_adventure_3_release_date.pdf
    • https://cdn.sqhk.co/bodavadu/ByjeIw0/primal_legends_hack_2019.pdf
    • https://cdn.sqhk.co/riwaxagi/J2jjzjd/64230881655.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/fipijife/calculus_2.pdf
    • https://s3.amazonaws.com/vosimalume/madurowekunemogizoworu.pdf
    • https://s3.amazonaws.com/fifuto/what_colors_make_sage_color.pdf
    • https://s3.amazonaws.com/ziwuvijevo/5_love_languages_test_free_online_gary_chapman.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e94e.bin
08b02310bc44b05f5ed9a463ea089f9155c210045535ec495e0bb01567636767		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE94E 5388 bytes
font_01_sfnt_off0000fb7b.bin
c47dc4273ff83e438eb7c8dbf54a7680279a19ebec58e9ec1734a8d697e62d8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB7B 10812 bytes
font_02_sfnt_off00012094.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12094 16204 bytes
font_03_sfnt_off000135c4.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135C4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.