Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bcb8c39fafec850…

MALICIOUS

PDF

82.2 KB Created: 2021-05-01 09:36:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: c84ea4c03285d750a28020b7f8e23f27 SHA-1: 251afaed4b684140e6a8a26514b5b19d82e17c0c SHA-256: 3bcb8c39fafec85006df8e82181fcc983e1cc604c0da90b19d1fbc031c6ee869
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as a phishing attempt. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, suggests a lure related to educational content, likely to trick users into clicking the malicious link. No scripts were extracted, but the presence of external URIs points to a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=grammar+activities+for+high+school PDF link annotation
    • https://sinekaku.weebly.com/uploads/1/3/5/9/135964305/vumibenupizunafonagi.pdfIn PDF document text
    • http://characduwe.space/cpt_book_2020muzle.pdfIn PDF document text
    • http://mon-fortuneo.best/cheerleader_trumpet_sheet_music_freebv6bp.pdfIn PDF document text
    • https://bamukozigo.weebly.com/uploads/1/3/1/4/131406799/8b7786af.pdfIn PDF document text
    • http://zonamumajotodot.iblogger.org/api_570_book_free_download.pdfIn PDF document text
    • http://arnautmebel.ru/2126981849992j2u.pdfIn PDF document text
    • http://gufutaca6.xyz/27691228494c7bxe.pdfIn PDF document text
    • http://trening-ekaterinodar.ru/wedowonos72fm.pdfIn PDF document text
    • https://bopilopuneliniw.weebly.com/uploads/1/3/5/3/135304065/murixozunubawup.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_900615972be54e37bbcc1e77e56bb4b5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/likerajatob/zolewogolonaxalagenew.pdfIn PDF document text
    • http://zilaxeputeso.epizy.com/4889334322.pdfIn PDF document text
    • https://s3.amazonaws.com/boduxatavepe/43906131321.pdfIn PDF document text
    • https://s3.amazonaws.com/mubemutolewe/one_group_pretest_posttest_design_statistical_test.pdfIn PDF document text
    • https://bc5ba30c-e427-49eb-abc4-9677f18f04c1.filesusr.com/ugd/bcd086_dea8dc59379d4a33bc92e4cedffc787d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f8d21ad-0d91-4069-a494-e1b08616b85e/42928913923.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcb30639-e815-4666-baa4-c2ac418a2b64/84790891231.pdfIn PDF document text
    • https://s3.amazonaws.com/megelugik/king_platform_bed_low_headboard.pdfIn PDF document text
    • http://ramuzetajomi.rf.gd/shapes_and_patterns_worksheets_for_class_3.pdfIn PDF document text
    • https://469ee322-798e-4c1d-9571-af6764901f97.filesusr.com/ugd/57169b_ad339e6d529741ffa12366ccaeca0bb0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dukexajuj/9980079132.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001068d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1068D 5388 bytes
SHA-256: 53ee8d7149ed98e039afb93944a15f20a1ecd69baf69a1a7fcdd9e4737be26c0
font_01_sfnt_off000118c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118C5 10164 bytes
SHA-256: 301d0de2cfc1d312bb0755a07a0a9a430716cc09c59966a7a63304ceb80b4723

Open this report in the interactive analyzer, or submit your own file for analysis.