Malicious PDF — malware analysis report

Static analysis result for SHA-256 38fe2b4b3a1042b4…

MALICIOUS

PDF

114.0 KB Created: 2021-03-06 04:08:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 7de28bf2631eae2da79451027cb08379 SHA-1: a2e9629f57165a074c621e8f44a06c1bcd7d8445 SHA-256: 38fe2b4b3a1042b4ac357790501d789ebfbdd1cedb27bba5d2d6273cb94f6972
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. The document body, though heavily obfuscated, suggests a lure related to 'worksheet answers'. The embedded URI points to a suspicious domain, likely serving the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9866

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=incredible+human+machine+video+worksheet+answers PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4484126/normal_6003af1890898.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420248/normal_600dfeb059f49.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483587/normal_5fe052a25c21e.pdfIn PDF document text
    • http://gemajesubon.22web.org/jezuzevulojoparefax.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.thdl.org/http://www.thdl.org/TibetanIn PDF document text
    • http://www.fontrix.comhttp://www.nhncorp.comIn PDF document text
    • https://8fa10226-37c2-454d-bd65-ced70ecbf0c4.filesusr.com/ugd/c34aa9_4a5d8ba9168348abaff5827441c33aa3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b31dcfd-1f89-4f52-98e8-ee80ef473b22/71904884315.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db4983f1-00ec-477f-8a62-6b966199aaaa/wunofaxomonekak.pdfIn PDF document text
    • http://jepitatumezelo.epizy.com/nodivipadafiput.pdfIn PDF document text
    • http://moliposapivar.epizy.com/english_tagalog_dictionary_free_for_pc.pdfIn PDF document text
    • https://s3.amazonaws.com/safenalavojuwu/becoming_jane_full_movie_480p.pdfIn PDF document text
    • http://banobozibijur.epizy.com/43473461360.pdfIn PDF document text
    • https://s3.amazonaws.com/kobivimelelo/44122918176.pdfIn PDF document text
    • https://s3.amazonaws.com/tezofuretejom/tuxevodikivagab.pdfIn PDF document text
    • https://63aa7d51-6c54-48cc-ac87-b710a0da19c3.filesusr.com/ugd/c8d394_864d8247886a4afa808aa7db249ea9aa.pdf?index=trueIn PDF document text
    • https://28ed73df-463f-41d7-bc87-4635118fd8e0.filesusr.com/ugd/74acc8_4ca3f25efd1944b78aec66d96918764c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/padanivozeb/quiz_logo_game_answers_level_25.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0842782a-b34f-4ff6-a096-cf17ab1b3d4a/weight_training_programme_for_runners.pdfIn PDF document text
    • https://s3.amazonaws.com/bisapovepizaj/agrobacterium_mediated_transformation_of_tobacco.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1baad2ec-763f-4ecd-9975-e774ea4964b4/how_to_continue_marriage_after_infidelity.pdfIn PDF document text
    • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_d460ba5c5bca441195e69300add142c5.pdf?index=trueIn PDF document text
    • http://rojikigekon.epizy.com/consent_to_medical_treatment_form_template.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlTibetanIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD7C 7000 bytes
SHA-256: c4055df0960568c9fe7516bf10d74b7eca9e6decca272c1ff1f25f8e7bfefc38
font_01_sfnt_off00010edf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EDF 3236 bytes
SHA-256: 967a6c52603b325980c03f620523b485598921b4bcf9f68680619f26cce428c6
font_02_sfnt_off00011a76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A76 5472 bytes
SHA-256: aa2efaf30771fde44df70e3925a566203215aa49c7c368164db1592baa07273c
font_03_sfnt_off00012cf4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CF4 8664 bytes
SHA-256: 24c2fa1e1355cbaea627ecf43868890a56c228345183fb168859a13df5c49aec
font_04_sfnt_off00013dd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13DD0 1796 bytes
SHA-256: e4f13a9bcdaf403615b21df5f7e52301cd46a6aabc56e8391a6b6e79d19a9adf
font_05_sfnt_off00014698.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14698 20072 bytes
SHA-256: e019e96273ee654e1cd4806d864eaa780677eb471654821e03922efedb0540aa
font_06_sfnt_off000183d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x183D7 16872 bytes
SHA-256: f01a1ab5cb5244aae6598af10b13fe6a93c62e5e65f39739e07adb30b02529a2
font_07_sfnt_off00019c09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19C09 2364 bytes
SHA-256: 070b60252e694798582d9bc8754e905705d3b9b90898d0b31031b821d269d8ec
font_08_sfnt_off0001a5cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A5CD 6780 bytes
SHA-256: 1fda92b3763210dd01749fb329c100ccbcc6da4d8821f737192704018e8a0b87

Open this report in the interactive analyzer, or submit your own file for analysis.