Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ee31032d89a2c34…

MALICIOUS

PDF

103.3 KB Created: 2021-05-18 06:07:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 294b552fd333cb004fe2c8359e677f1c SHA-1: d6b6d82e1c9e4ece0fda1407af00d8901f0d3da3 SHA-256: 2ee31032d89a2c344aade47db6d4c7c115d15ca88fa16dd8a38481a366698a67
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search result for academic papers, a common lure for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URI suggest it's designed to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=davv+cet+previous+year+papers+pdf+download
    • http://febefapowe.22web.org/matlab_gui_save_user_input.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9d9a184b-0fe6-467e-baed-6cc7796b662e/99397829422.pdf
    • https://s3.amazonaws.com/mijumomub/24886977377.pdf
    • https://s3.amazonaws.com/toniseligiwuzux/beastmen_mortal_empires_guide.pdf
    • https://uploads.strikinglycdn.com/files/31fe1a7b-4c9d-47f7-a7ba-aaecb5065166/45071969124.pdf
    • http://fopupasefe.rf.gd/kuxedaxasataroselerid.pdf
    • https://uploads.strikinglycdn.com/files/7809c8eb-81a8-469e-8f89-37090e87967b/gojajuxodik.pdf
    • https://s3.amazonaws.com/zidosozawok/chomp_sms_app_free.pdf
    • https://s3.amazonaws.com/natewared/jisep.pdf
    • https://s3.amazonaws.com/jinabisura/repizomazu.pdf
    • https://s3.amazonaws.com/wefemabeni/neuralink_white_paper.pdf
    • https://uploads.strikinglycdn.com/files/1134fe61-1082-421c-9f74-047c94b325cd/51651202975.pdf
    • https://s3.amazonaws.com/zetubakuz/dexatosudesijexov.pdf
    • https://s3.amazonaws.com/ganubifirigevi/39551704833.pdf
    • https://s3.amazonaws.com/wamatasamegu/lagu_tiny_dancer_elton_john.pdf
    • https://s3.amazonaws.com/zepifudoxapo/carson_dellosa_spanish_answer_key.pdf
    • https://s3.amazonaws.com/donarepemi/rirotu.pdf
    • https://s3.amazonaws.com/xasovewipeje/84802109118.pdf
    • https://s3.amazonaws.com/wefemabeni/rubupanuvozumobakedogaz.pdf
    • https://s3.amazonaws.com/farokof/percy_sledge_piano_sheet_music.pdf
    • https://s3.amazonaws.com/lovomijelun/how_to_use_motorola_elite_sliver_bluetooth.pdf
    • http://ratezerug.rf.gd/commands_of_autocad_2020.pdf
    • https://s3.amazonaws.com/xukanomarexumu/85508216395.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013ba5.bin
b29b080c277b1678329436ea5e1bcbd5445d5f2dabbcdc9fba4322abca3bd57e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13BA5 5400 bytes
font_01_sfnt_off00014e38.bin
f2121c481554f9d217e155168ff2e5b18e41e976d3b106c19f9a9f03a489407a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14E38 11984 bytes
font_02_sfnt_off00017739.bin
4bd16c8abd39118228c1571b0005d4eb3b3e943e572fd92a2a80cfcb7b749349		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17739 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.