Malicious PDF — malware analysis report

Static analysis result for SHA-256 31aed1587198b2b9…

MALICIOUS

PDF

89.4 KB Created: 2021-04-06 19:43:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f144eac3bb058f50bdd603ba0982fc1 SHA-1: 26046940a5761eff1846c0f3673504398679b9e4 SHA-256: 31aed1587198b2b91dfd397a05ea585b9f92f3fcaafa27e894f36f0b953ebbb9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that, when visited, likely leads to further malicious activity. The document body, though heavily obfuscated, contains text related to academic essays, suggesting a social engineering pretext to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=argumentative+essay+examples+for+university+students
    • http://mon-cmbretagne.com/naritisue1xw.pdf
    • http://domainlimax.xyz/mfj_949e_tuner_manualw4agw.pdf
    • http://sikepelisu.22web.org/52137126649.pdf
    • http://jaralimejisu.iblogger.org/a_first_course_in_abstract_algebra_fraleigh_free_download.pdf
    • https://fosewusoxakuw.weebly.com/uploads/1/3/4/7/134707282/1405348.pdf
    • http://copyright-securityx.com/sujulimasepemaxojipodikaj.pdf
    • https://mevukufidax.weebly.com/uploads/1/3/1/3/131379039/fe1a5b1c7ea941.pdf
    • http://lnstagramcopyrightcenter.com/kilejojeganemooiva3.pdf
    • https://timemojorejo.weebly.com/uploads/1/3/1/4/131437846/zowikid.pdf
    • https://dijizuwuke.weebly.com/uploads/1/3/3/9/133999270/balejab-fobuperubapepop-fukivosawam.pdf
    • https://vojerured.weebly.com/uploads/1/3/3/9/133999986/18fb4e9a190b6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dudasuz.epizy.com/jogagenaxugenojagogedev.pdf
    • http://rapuzezu.epizy.com/69405932121.pdf
    • http://genukofuseti.epizy.com/system_analysis_and_design_notes_for_bca.pdf
    • https://s3.amazonaws.com/wumodukubaru/94895338491.pdf
    • http://bofiragomux.rf.gd/dufujoxilenif.pdf
    • http://zosajaxuv.epizy.com/gusedavibesiwu.pdf
    • http://kenuzuwemonuda.epizy.com/car_logo_quiz_ppt_free.pdf
    • http://fawamoru.rf.gd/14280605468.pdf
    • https://s3.amazonaws.com/woxojuxafopuv/blue_star_software_for_pc.pdf
    • https://s3.amazonaws.com/bizamesuwepe/74083844745.pdf
    • http://supetok.rf.gd/direction_worksheet_for_grade_5.pdf
    • http://pajamenu.rf.gd/majatobutazufudof.pdf
    • http://xogamix.rf.gd/convert_cdr_file_to_without_coreldraw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011ec8.bin
9e3a95d61c563096a35c474c5cc00d651ddef28f529e1ba3af580a05f34ac4ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11EC8 5580 bytes
font_01_sfnt_off000131c1.bin
c83ee636822fb82950d010440018ba9614eb67a1decef51877d8a44224231a5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131C1 11016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.