Malicious PDF — malware analysis report

Static analysis result for SHA-256 392907316f02a4a6…

MALICIOUS

PDF

86.1 KB Created: 2021-07-21 16:46:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 1c6142d947385de4dbb2cf7a148e5bbf SHA-1: a0cab7bc7a0bf20332cd9ff454324e27eb2ac7b3 SHA-256: 392907316f02a4a6442849cbdee86cac1e3af93cc27537a21e679867b43df702
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'https://nomylo.ru/square?utm_term=purple+and+blue+names' was extracted, suggesting the document's purpose is to redirect users to this potentially harmful site. The document body is heavily obfuscated, preventing a detailed analysis of its specific content or embedded scripts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/square?utm_term=purple+and+blue+names
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f4bb6c1ad9bf1c32c43e8e/1626651500623/16987941005.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f11367b0b7347a52244997/1626411880039/bakewell_lake_district.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f269e0db752c5e49a29544/1626499552757/learning_to_roller_skate_at_40.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e9657c3f195e1e4038491a/1625908604779/ladojogefa.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60eded35a9aa746350cd83b7/1626205493511/make_word_document_fillable.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e819c5f29cd6423db6d55a/1625823685724/72643366896.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f7c14e6c9f8c4332432508/1626849614531/75989906934.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f4340b6f491d4a1ff9c2b8/1626616843207/good_science_questions_and_answers.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8b85ab7022a177a58816c/1625864282623/an_interesting_question_in_spanish.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f0b8ea78fb23041afaa04c/1626388714697/sex_and_the_kitchen.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e770e3a336ab736a1eca26/1625780451538/maybe_so_meaning.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e9121937cb9044755f69d4/1625887257647/definition_of_radiometric_dating_in_science.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f1b638e4c32d6f41f78921/1626453560997/xoditupi.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f22b3b0b1749089201d180/1626483515549/set_for_life_results_excel.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ed8e9639532c3941c258f4/1626181270928/quotes_about_hard_times_and_love.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f1e63329b89860490c87f2/1626465844080/two_column_proof_definition.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ecae05cc72356efe9430a4/1626123781176/39951189261.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e779b4d31d7a3b360285fe/1625782708774/dajajakorevefaxukomepino.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f74f7c2023e7309b03804c/1626820476642/currency_sgd_to_idr.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f262d3731d8c7c6ff35410/1626497747575/75398700693.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f34e6ba8f65e35b6d98484/1626558059542/betting_odds_on_college_football.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edfe.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDFE 16792 bytes
font_01_sfnt_off00010610.bin
db74ced578f1afe1e642b670074d4799336a4682c8008b07b212efca0bb2374b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10610 17300 bytes
font_02_sfnt_off00013349.bin
25d6d99a792f82970cc8096b4b140aaf56606835ba9a9bdc2b0b1a9e9940a254		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13349 10484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.