Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dcbe7d368e81487…

MALICIOUS

PDF

84.8 KB Created: 2021-06-14 13:01:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d198bda287988264555ddb420032050b SHA-1: e1633e7a1f2831583d65a76c44f537853277e409 SHA-256: 2dcbe7d368e814875974a918f6d68fbfa23580cad3fedbabeb291a0004563888
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URL that leads to a page discussing 'pros cons gmos', likely a lure. While no scripts were directly extracted, the PDF structure and embedded URI suggest a phishing attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/pbw?utm_term=pros+cons+gmos
    • https://cdn-cms.f-static.net/uploads/4460072/normal_600d8da2e0d7d.pdf
    • https://static.s123-cdn-static.com/uploads/4369772/normal_5fcc100b6e0e3.pdf
    • https://static.s123-cdn-static-d.com/uploads/4415051/normal_60b73a00a0472.pdf
    • https://cdn-cms.f-static.net/uploads/4373757/normal_60c37feb568a3.pdf
    • https://cdn-cms.f-static.net/uploads/4407313/normal_605cef7b029f1.pdf
    • https://static.s123-cdn-static.com/uploads/4382196/normal_5fcfe91c818ca.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/91b4a545-150c-440c-ab7c-2902da7130ee/samsung_refrigerator_rs265tdrs_ice_maker.pdf
    • https://uploads.strikinglycdn.com/files/fd0c110f-af67-4df9-8e29-3b09b867f5f2/15096901469.pdf
    • http://xutipofapu.pbworks.com/w/file/fetch/145160124/takapupunuwudajozazoma.pdf
    • http://juxivos.pbworks.com/w/file/fetch/144667992/47408832344.pdf
    • http://bokibagaror.pbworks.com/f/edgenuity_english_10_unit_test_answers_sugar_changed_the_world.pdf
    • http://kirozatijawu.pbworks.com/w/file/fetch/144510762/41160380873.pdf
    • https://uploads.strikinglycdn.com/files/80a3b8e5-2f8a-41a4-a49a-300249389110/el_monstruo_de_colores_actividades_preescolar.pdf
    • https://uploads.strikinglycdn.com/files/0f3739dc-3c16-4cea-a61f-732b1f91e1b0/libertango_astor_piazzolla_violin_sheet_music.pdf
    • http://duziruromeja.pbworks.com/w/file/fetch/145244625/subtraction_of_mixed_fractions_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/a3eee4ee-3f9e-4ca0-bcb0-48a976e6e469/oscar_et_la_dame_rose.pdf
    • http://tefuraviwuw.pbworks.com/f/81706628600.pdf
    • http://gafuxexosaru.pbworks.com/f/36785988342.pdf
    • https://uploads.strikinglycdn.com/files/4f25133e-fa0a-4f27-bb86-fb9f98a2c82d/95684438951.pdf
    • http://lujugusoderu.pbworks.com/w/file/fetch/144935928/pobupetamenukenarafin.pdf
    • https://uploads.strikinglycdn.com/files/51b8a39c-b066-40c1-b844-e2d3ce4dba05/mixing_and_mastering_school.pdf
    • http://dutamaboxiwa.pbworks.com/f/43364928842.pdf
    • http://fevawigo.pbworks.com/f/how_to_install_diaper_genie_refill.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001039f.bin
37240b3a550b107999da81116c350ef0f7853419d8026851fcfb318eea8127fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1039F 4420 bytes
font_01_sfnt_off00011265.bin
726f8cf7b6997cf7b0b613f53f738c72418683a5089eaff80404b6fdff62499d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11265 10948 bytes
font_02_sfnt_off000137b5.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x137B5 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.