IcedID — PDF malware analysis

Static analysis result for SHA-256 3390b1d8560f565e…

MALICIOUS

PDF

380.0 KB Created: 2023-01-20 05:50:28 -08:00 Authoring application: iTextSharp’ 5.5.13.2 ©2000-2020 iText Group NV (AGPL-version)
MD5: b3117b93c996f51784424c576852b526 SHA-1: 4dfeef29de29f9a0a123a7c8751c2a887b807d7c SHA-256: 3390b1d8560f565ed5e2a60df63ce24abe0ef3da514cf5645dd732f7e5cdbbae
170 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The PDF contains invisible and repeated links that lead to a ZIP archive hosted on Google's Firebase Storage. ClamAV identified this as Pdf.Trojan.IcedID, and ML classification further supports its malicious nature. The primary attack vector is the lure to download and execute the payload from the provided URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8804

Heuristics 4

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • ClamAV: Pdf.Trojan.IcedID-9983376-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Trojan.IcedID-9983376-2
  • PDF paints image(s) but contains no text operators medium PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://firebasestorage.googleapis.com/v0/b/warm-airline-372420.appspot.com/o/QSPCMw89Wo%2FDocument_31.zip?alt=media&token=86396b49-df6b-4d9e-8aab-fb3f2215622a