Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ef0281362629dd1…

MALICIOUS

PDF

221.8 KB Created: 2021-03-19 06:21:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 126207c9b77ae54a530e5497f0f10ac2 SHA-1: d66442a3fab0ccfa98af4f8ac61ec1bd6017d9e6 SHA-256: 2ef0281362629dd19472936854ae13ceeb586816dc6e73d1b179547bf26331f7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search query, likely intended to trick the user into clicking it. While no scripts were directly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=geometry+regents+june+2017+answers+explained
    • https://fanejutasoja.weebly.com/uploads/1/3/5/3/135399707/pafedu.pdf
    • https://pawonojureva.weebly.com/uploads/1/3/4/5/134522231/jefakogewubawarares.pdf
    • http://kufowawixapiva.sportsontheweb.net/definition_of_development_planning.pdf
    • http://zitalogeloluwiw.mygamesonline.org/gajuwazisufejeziginufi.pdf
    • http://vesajob.getenjoyment.net/dagajiwibikelufed.pdf
    • http://leziwazedo.mypressonline.com/learn_python_3_the_hard_way_download.pdf
    • https://dapalijika.weebly.com/uploads/1/3/0/7/130738969/nobuzu.pdf
    • http://vadanunagirira.getenjoyment.net/birixilepidubawojap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bulolimepol/19327261870.pdf
    • https://uploads.strikinglycdn.com/files/835f9ba8-c466-497d-8032-180063c6ee85/puvix.pdf
    • https://uploads.strikinglycdn.com/files/8d0575d5-8c10-4ec1-8754-9f2dfce40c93/quintiles_interview_questions_for_clinical_sas_programmer.pdf
    • https://s3.amazonaws.com/vavapekadoliti/68365762502.pdf
    • https://uploads.strikinglycdn.com/files/8c084ae4-a576-47c0-8304-df34f8f26243/purple_cow_drink_menu.pdf
    • https://s3.amazonaws.com/lakujusitejojet/last_cloudia_beginner_guide.pdf
    • https://uploads.strikinglycdn.com/files/7180298b-a0da-4e76-98d6-828dc42a4736/zaguvibogogonolo.pdf
    • https://uploads.strikinglycdn.com/files/7e7c1fef-7cf1-4810-8090-dad307de031b/how_to_replace_ink_in_canon_p170-dh.pdf
    • https://7afd96e6-4611-46d4-9b98-d111b897c281.filesusr.com/ugd/154221_cd90d9822db648fba3c30ee2c244d414.pdf?index=true
    • https://8909b315-4d59-4940-aabf-0fdaa532e0ad.filesusr.com/ugd/4542d9_a5807045e9d64f28bd91863aaac7b0db.pdf?index=true
    • https://aa3bb5c3-2bd4-4791-9e2a-6e31d5009b04.filesusr.com/ugd/60e703_ba338f4984224d62b43dd63aa79583c0.pdf?index=true
    • https://6f465708-eb37-4ee2-8658-ebeec6cd93ea.filesusr.com/ugd/4bb103_05db8776c87a4737b27d1973a35b3135.pdf?index=true
    • https://s3.amazonaws.com/sefipa/manual_de_automatic_pump_control.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00032883.bin
25e588011a4fad31f16205734b02b22dfcc243bbc77bf2ff5c95f2e61aec0bd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32883 6056 bytes
font_01_sfnt_off00033d3b.bin
8712071077d736e953a165d47e0df829690011fca66373d075ae36747f8864ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33D3B 13440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.