Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c14268bd6a054bb…

MALICIOUS

PDF

173.1 KB Created: 2021-05-27 10:12:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 128423205e9415430acce70eac236d12 SHA-1: 77a5125ecaf5c140a9e4b694f88bcbe6a7365de6 SHA-256: 2c14268bd6a054bb722e4c02a48a5500fd2fceb3a94fbf85ef84602d3924c22d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a lure related to an 'answer key', aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=chloroplast+and+mitochondria+packet+answer+key
    • https://derunemutojo.weebly.com/uploads/1/3/7/5/137517297/xadalamivibudox.pdf
    • https://verikadofaja.weebly.com/uploads/1/3/2/3/132303102/9e927.pdf
    • https://tinuxapesizagi.weebly.com/uploads/1/3/4/4/134440362/gativowobogog.pdf
    • https://cdn-cms.f-static.net/uploads/4454430/normal_60501b8ee893e.pdf
    • https://cdn-cms.f-static.net/uploads/4417519/normal_602159f41f538.pdf
    • https://static.s123-cdn-static.com/uploads/4411686/normal_5ff9ce2baf889.pdf
    • https://cdn-cms.f-static.net/uploads/4408460/normal_601a5d6a31e31.pdf
    • https://cdn-cms.f-static.net/uploads/4388426/normal_602a3de95206c.pdf
    • https://cdn-cms.f-static.net/uploads/4454694/normal_5fdb195fa7f67.pdf
    • https://rajaxamakato.weebly.com/uploads/1/3/2/3/132302926/sijajozowotak_rekupuri_vokuzuwometom.pdf
    • https://static.s123-cdn-static.com/uploads/4495694/normal_5fee8a879e351.pdf
    • https://cdn-cms.f-static.net/uploads/4426407/normal_6027559189273.pdf
    • https://vevusivo.weebly.com/uploads/1/3/0/8/130874001/8134956.pdf
    • https://feditesar.weebly.com/uploads/1/3/1/4/131483001/097f2c52f.pdf
    • https://static.s123-cdn-static.com/uploads/4443372/normal_5fdf880dc3a7a.pdf
    • https://divugukapo.weebly.com/uploads/1/3/4/7/134706398/dagetidit.pdf
    • https://cdn-cms.f-static.net/uploads/4494866/normal_606302516d4dd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1d38ee64-7fa4-4f13-a24c-4c993c0150cc/19852191292.pdf
    • https://uploads.strikinglycdn.com/files/99f755d4-e06c-4521-9c4f-48ade92e61f3/gumunu.pdf
    • https://uploads.strikinglycdn.com/files/508f2ba6-c1ab-46f9-a10c-8e23ca444460/11835571516.pdf
    • https://uploads.strikinglycdn.com/files/bedbc780-f25f-4c38-9ada-437b60250caf/los_5_lenguajes_del_amor_quiz.pdf
    • https://uploads.strikinglycdn.com/files/4b43d4cc-1c8f-42e4-ae6b-1cad9c44c87c/xuxorudizofojifu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000235fe.bin
52a2aa1cc377d431e6d8cd8c35ce7161dad1b7db71c452e47f67769f8d7d5e93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x235FE 10488 bytes
font_01_sfnt_off000258c1.bin
cdce8ac75cfc2a159a571f0d31eb6aced9c747f08863a714112016cffa486d72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x258C1 5476 bytes
font_02_sfnt_off00026b45.bin
3799c7eda162d46a518ffe59b6de8bb5874209f4380826746cb43da516dbc2ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26B45 19900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.