Malicious PDF — malware analysis report

Static analysis result for SHA-256 305f05ee91f82bd4…

MALICIOUS

PDF

68.8 KB Created: 2021-03-02 04:56:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 10797d0168e47830f3e1d6bbac4ec4a7 SHA-1: a88d6f8d7a38737e3ff448592fc727c670dcb901 SHA-256: 305f05ee91f82bd41d7103a280d27dd2d38f3610c078bd329b468eea4703a052
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is a strong indicator of malicious intent. The ML classifier and ClamAV detection further support this assessment. The document body, though partially corrupted, suggests a lure related to 'compound predicate worksheets', likely a pretext to drive users to the malicious URL for phishing or to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=compound+predicate+worksheets PDF link annotation
    • http://kuxakutefop.22web.org/can_you_get_goat_simulator_on_nintendo_switch.pdfIn PDF document text
    • http://sopesukenapad.scienceontheweb.net/stock_market_crash_in_new_york.pdfIn PDF document text
    • http://lobabinuladeri.medianewsonline.com/how_to_apply_for_medicaid_for_elderly_parent_in_pa.pdfIn PDF document text
    • http://fuziral.iblogger.org/free_downloadable_math_worksheets_for_kindergarten.pdfIn PDF document text
    • http://strahauto.website/1842271214p38mg.pdfIn PDF document text
    • http://nomenowunesazoz.scienceontheweb.net/tufajufogoximotojegejumer.pdfIn PDF document text
    • http://gofadivus.mygamesonline.org/34650058288.pdfIn PDF document text
    • http://malanefire.sportsontheweb.net/omron_bp710n_error_codes.pdfIn PDF document text
    • http://xavelodezazil.iblogger.org/rustoleum_cabinet_transformations_how_many_top_coats.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dosipive/cisco_sg300-10p_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/voxazedisula/periodic_table_with_charges.pdfIn PDF document text
    • https://s3.amazonaws.com/veraxawewib/how_to_buy_perfect_money_with_debit_card.pdfIn PDF document text
    • http://tesoxukezeziles.epizy.com/circuit_court_case_information_chesapeake_va.pdfIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/facial_expressions_test_worksheet.pdfIn PDF document text
    • http://vedaremix.epizy.com/xaromavizapitugi.pdfIn PDF document text
    • https://s3.amazonaws.com/vinivuxo/letter_c_coloring_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/daraniwekamidir/rirulizubegukexage.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1CC 5340 bytes
SHA-256: e9e1aa148527b292d1fed7f12e9e9c5ffdb5d4684be4363f6c9e8cbf4a9a61b3
font_01_sfnt_off0000e3d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D8 10004 bytes
SHA-256: f5b52c7c8ff1f77c5ea677ecef846657193abe6e9b3539ee3f9ee79327347f09

Open this report in the interactive analyzer, or submit your own file for analysis.