Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ec4303da117a598…

MALICIOUS

PDF

94.9 KB Created: 2021-03-15 19:33:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc2a29f613f9269438a0cbe94cb51d2f SHA-1: d3fb3e1639504d1dc21f41bc6a640f2c1f7c37bc SHA-256: 2ec4303da117a59869e678737930406e4b171928e9d4de5858b527bcc2894692
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, appears to be a lure related to academic content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/aws?utm_term=how+to+determine+intermolecular+forces+strength
    • https://static.s123-cdn-static.com/uploads/4418362/normal_6002d8cade2f8.pdf
    • https://cdn-cms.f-static.net/uploads/4465012/normal_5fd33c609c8fc.pdf
    • http://myyshooop227.site/carlos_castaneda_downloadqsobn.pdf
    • https://cdn-cms.f-static.net/uploads/4417830/normal_6017a45ec88c8.pdf
    • http://bred-enligne.com/precalculus_with_limits_3e_online_textbookwzr1v.pdf
    • https://static.s123-cdn-static.com/uploads/4366407/normal_5fce078f5a056.pdf
    • http://lijonotogi.scienceontheweb.net/how_to_charge_polaroid_speaker.pdf
    • http://axecheat8.xyz/canon_rebel_t5i_18mp_dslr_cameraa4gnq.pdf
    • https://static.s123-cdn-static.com/uploads/4467287/normal_5ff04b007a8d1.pdf
    • http://jarewitof.mypressonline.com/artemis_fowl_time_paradox_audiobook_nathaniel_parker.pdf
    • https://cdn-cms.f-static.net/uploads/4482002/normal_604d98ba80f93.pdf
    • https://static.s123-cdn-static.com/uploads/4485695/normal_6007b897b0f33.pdf
    • https://cdn-cms.f-static.net/uploads/4392210/normal_602634221554e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0fe83ef2-ed6b-4f04-a52d-31fe3c58d8d1.filesusr.com/ugd/ade4e6_9cd95dfc56014fbb9fd8f93dc328c188.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4d6cc37d-48f4-4949-9ab2-585db8fdfad0/goffman_presentation_of_self_social_media.pdf
    • https://uploads.strikinglycdn.com/files/2d9cf82e-e4b4-41c7-9f9b-024d9d9ba2b6/43734434919.pdf
    • https://uploads.strikinglycdn.com/files/a0d81eeb-7511-4ac8-a329-3af50a0b3015/buzetorabajog.pdf
    • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_789f6a246c7f4517aa06801ef0b7bd1f.pdf?index=true
    • https://02aee961-309f-4c8b-9790-08f12c26706e.filesusr.com/ugd/8321db_92997b92f7344b69ba2bf74e45966bf5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011f01.bin
a39789068863d01a7934b959c4329604d2282c913322c3d9dc59ff9614914e91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F01 5488 bytes
font_01_sfnt_off00013192.bin
0a9e1f4ac3d908a9bb88ec32756a38f5448281e7c9745fe7850d59392b19dbd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13192 11520 bytes
font_02_sfnt_off00015931.bin
713933360072c9d59346590fad668f98c3603c6d2b72ed941ce85481f6af0b74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15931 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.