Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c8b1e51c1142e42…

MALICIOUS

PDF

192.7 KB Created: 2021-07-17 10:27:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: cb808b43372719f12015099e1092fe85 SHA-1: 35b731a4dcc442821060b24228cd6d9d1158fe21 SHA-256: 2c8b1e51c1142e424fac3d0515d0c05b5eb47f43561ac1c171f16b4075f7b3b8
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ClamAV heuristic identified this PDF as a phishing trojan. The embedded URL, while flagged as benign, suggests an attempt to redirect the user. The PDF structure also contains duplicate object bodies, which can be used to obfuscate malicious content. No scripts were extracted, but the overall pattern points to a phishing attempt via a malicious link.

Machine Learning

  • Nyx PDF Classifier clean score 0.0115

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/qI_NY8u86tA/square?utm_term=my+body+is+mine+song
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60eca9b19c874e71424bab6e/1626122673942/17821861562.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f23be6c4d0d61e672cb98b/1626487782630/annabelle_comes_home_streaming_vf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000283cf.bin
548fd490ef4a276294978fbd7646743dd33fec30ffa9e9ab0a600bb1ecfdcc6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x283CF 10432 bytes
font_01_sfnt_off00029b2b.bin
9b3f322cce20f721c3a2cfe765c18c85a0592f3ecf67ed7d4e1c195dc6d1fb80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29B2B 20196 bytes
font_02_sfnt_off0002cf38.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CF38 16792 bytes
font_03_sfnt_off0002e745.bin
15616ea71c13adba2e411b64305a4e603fa6246856b1ea67b0f40af1fea9dec8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E745 3832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.