Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f49cb3331a0c0fb…

MALICIOUS

PDF

84.0 KB Created: 2021-07-21 21:00:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 92742c1a78e8597fd9837a71059bc23b SHA-1: 8018afb00ba986cfe21f1d074ae126a6245f6456 SHA-256: 2f49cb3331a0c0fb13968d259cb508ea168f2741549a6f6312ea97193a04296f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI that points to a Google feed proxy, which in turn redirects to a PDF file hosted on squarespace.com. While the specific URLs extracted are marked as benign, the overall detection suggests malicious intent, likely related to phishing or malware distribution. No scripts were extracted, limiting the analysis of the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/iYdez4bKglI/square?utm_term=cooking+spiralized+courgette
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60edb09654e5b71ae8500d14/1626189974105/43156922322.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f84c51b3340079c68278d6/1626885201955/20832594899.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f7e56a53df297156b69b02/1626858858266/xitatozokiwutowojovi.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f2174954c26a0cc3ef0a8e/1626478409629/lower_than_normal_blood_pressure_is_called.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f61c7f3b8c3407e1abca17/1626741887208/juvemubabakave.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f0b9c99627e70a9ac802e7/1626388937442/change_timestamp_on_photos_android.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f07941faec3a5c4dab9967/1626372417307/tubidy_com_music_mp4_download.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f58046b84a576e6c19d1f1/1626701894819/gabunadawajune.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f4094ec5d9e6782ce80765/1626605903121/25584428257.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f064ac1c6cf24172e43294/1626367148161/cbse_class_8_english_textbook_solutions.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e7b7f6d56f0f36126f493a/1625798646976/layered_hair_blow_out.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f2f5b9c2d40e67ec05ef70/1626535353467/i_have_access.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8cba054872c510b8f395d/1625869216097/search_results_pagination.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f1bb9d5861144f85c15670/1626454941771/tomorrow_and_tomorrow_charles_sheffield.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e919068ce0e10532d27f5e/1625889030364/79678844692.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec7fb5dd2ac847ff7e3b3a/1626111925936/38177372165.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e772e163e952391ed39b3c/1625780961688/reverse_charge_on_legal_services_under_gst.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f09a4fa91b8a4c9e160c50/1626380879886/blue_is_the_warmest_color_book.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f105bd8cd1ac765d4d94bd/1626408381811/san_francisco_police_misconduct.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8c16aaba27f4cd4bd0fd1/1625866602195/82366779768.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec87f7ad4a1a22a3e7dfb6/1626114039251/banking_seating_arrangement_questions.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec9bfe0f7d8d50062dffb5/1626119166715/wowuxitebodebabibi.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f3eeb66c177f33d7a897f7/1626599094639/what_is_homogeneous_and_heterogeneous_mixture_with_example.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e571.bin
fde2860fd782333bd68b11a8d8009f82c4c3f8d7f465c44cd9d87b92445afcc2
pdf-font-stream PDF embedded font (sfnt) at offset 0xE571 10972 bytes
font_01_sfnt_off0000fee4.bin
26c83bdb0dcd9c4bd4f843a34004103aa4ab3dc19519a5df1e62f9ca2d001a31
pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE4 16852 bytes
font_02_sfnt_off00012ab8.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
pdf-font-stream PDF embedded font (sfnt) at offset 0x12AB8 16792 bytes