Malicious PDF — malware analysis report

Static analysis result for SHA-256 2fb4b60868ea2b93…

MALICIOUS

PDF

73.6 KB Created: 2021-03-21 06:58:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 41643f71d21b7ea3c0aac8bf86d6b732 SHA-1: 16b6f3fd8addf5fcd0d98be77acf98e859817e87 SHA-256: 2fb4b60868ea2b9325060b234d4749b4dea3b93add3d375040724c78c68643c7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains embedded URLs that lead to suspicious domains, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to be a lure related to a 'deca marketing cluster exam study guide'. No scripts were extracted, but the presence of external URIs points to a likely attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=deca+marketing+cluster+exam+study+guide PDF link annotation
    • http://sukutoxuwurif.mywebcommunity.org/human_behaviour_at_workplace.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417216/normal_60548382e98e2.pdfIn PDF document text
    • http://stickerrus.ru/ddp_yoga_app_heart_rate_monitor34zeq.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412568/normal_605682e629175.pdfIn PDF document text
    • http://love-your-lips.online/aprender_a_dibujar_manga_desde_cerouxh8x.pdfIn PDF document text
    • http://sport-stavki.fun/rixedimewolebefighmnfq.pdfIn PDF document text
    • http://kmplitka.shop/53302829657gmvw6.pdfIn PDF document text
    • http://kindraretterath.com/411666834336jwfc.pdfIn PDF document text
    • http://fumigatoff.online/jugar_galaxian_online_gratiszy9kt.pdfIn PDF document text
    • http://moscowflowers.shop/what_to_do_if_an_employee_tests_positive_for_covid_bcxo4xc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381964/normal_5fd60f4fe85a2.pdfIn PDF document text
    • http://claire-irk.ru/ciclo_teniases0ntc.pdfIn PDF document text
    • http://gadatoreneperil.mygamesonline.org/how_to_become_a_small_engine_mechanic_in_alberta.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fuwuzerijofa/mechanism_of_mitotic_spindle_formation.pdfIn PDF document text
    • https://s3.amazonaws.com/dofufiri/blade_and_soul_weapon_skins_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2bf12cc-7507-45cd-9e67-340cfa1ba35d/93288316109.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9692617a-c096-412c-bf58-1ebfad19f35c/fundamentals_of_physics_by_halliday_resnick_walker_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/mudurixo/gatov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad32d638-91d9-4ca0-a6ab-de7a3a9958aa/tegidexoginezit.pdfIn PDF document text
    • https://s3.amazonaws.com/sumesawoxajew/doresolawitibagun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/132cc15f-2967-4d9b-9b4b-02b5d5312f77/samsung_bn59_remote_app.pdfIn PDF document text
    • https://s3.amazonaws.com/wujixus/what_does_piebald_dachshund_mean.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e191.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE191 5492 bytes
SHA-256: d8596d5755db4572661b5ced521a972d063fdd392c8ef8bb43a8bd7c88f54f29
font_01_sfnt_off0000f43c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF43C 10776 bytes
SHA-256: e4e81ea07b51823db521509c2a1b7eb67b20b7a961bb0998bb7e42a2182c0611

Open this report in the interactive analyzer, or submit your own file for analysis.