Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ac37b00c3f585be…

MALICIOUS

PDF

452.2 KB Created: 2021-03-17 16:45:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 53e30d84412a6c47c74e5bca2f7ef84f SHA-1: 2a17b4c33093111b435c5a3c8f31d981c7b60bba SHA-256: 2ac37b00c3f585bedbbed31cac500be7abe03b90a736f5f239159a1c150ae462
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains an embedded URI pointing to a URL that appears to be a lure for downloading a file, likely a malicious second-stage payload. The document body, though heavily obfuscated, suggests a 'cell cycle quiz' theme to entice users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8429

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=cell+cycle+quiz+pdf PDF link annotation
    • https://solugelefeko.weebly.com/uploads/1/3/0/7/130740562/tuwanofabi-keruluxomewen-muberexazi.pdfIn PDF document text
    • https://mipapipav.weebly.com/uploads/1/3/4/0/134012398/sevugomorejugaka.pdfIn PDF document text
    • https://cdn.sqhk.co/fabukujeb/giidgjl/magic_piano_tiles_kpop_exo.pdfIn PDF document text
    • https://cdn.sqhk.co/ligumorik/NxejaXQ/1136416097.pdfIn PDF document text
    • http://vidclips.design/paco_el_chato_secundaria_espaol_volumen_2_segundo_gradon5kfb.pdfIn PDF document text
    • https://cdn.sqhk.co/zonakagud/hAhbjfF/fatiluvanukawim.pdfIn PDF document text
    • http://uscarins.info/91740525778fok2e.pdfIn PDF document text
    • https://cdn.sqhk.co/jaziwuke/iif3Cgf/61356758055.pdfIn PDF document text
    • https://kofivenemiwelew.weebly.com/uploads/1/3/1/3/131380814/wetewe-polikujitovad-vezubuza-famoxixax.pdfIn PDF document text
    • http://skidki-day.store/aararum_kaanathe_aarodum_chollathe_songks5rg.pdfIn PDF document text
    • http://ses-paypal.com/minozezi6kzqw.pdfIn PDF document text
    • http://bellissimo.online/free_little_drummer_boy_piano_sheet_musich2opj.pdfIn PDF document text
    • http://pokupka.space/how_to_meet_the_vampire_diaries_cast_2020lvqe5.pdfIn PDF document text
    • http://like-store.site/56817277591l1i0z.pdfIn PDF document text
    • http://justamorem.com/21105898650cov4w.pdfIn PDF document text
    • https://cdn.sqhk.co/tekonunise/LphbJV3/80811062757.pdfIn PDF document text
    • http://hh666o.site/43490181475fqkr2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_ef414915df814d2da105333f607d2ff0.pdf?index=trueIn PDF document text
    • http://jipidabaxepej.epizy.com/fluoroantimonic_acid_safety_data_sheet.pdfIn PDF document text
    • https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_05f7581d73eb496993a56ec86b9a25ee.pdf?index=trueIn PDF document text
    • http://meganisaniwo.rf.gd/88456988907.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0006aca7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6ACA7 4848 bytes
SHA-256: 1be3559b38c368391bb01b483571de82ad278b13e08b68e7cde280dbb9dda3a6
font_01_sfnt_off0006bd4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BD4E 13912 bytes
SHA-256: 22f6b0b0665a73f546dfa5a3b1a0df55f27a556bc6d453d30255365154a46a41
font_02_sfnt_off0006ea7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EA7E 16172 bytes
SHA-256: f22b3773b7b877c5f1051559c92fa2d7d33937df14275e3dded0715bbdddbaa7

Open this report in the interactive analyzer, or submit your own file for analysis.