Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d6a932876f07cf0…

MALICIOUS

PDF

92.9 KB Created: 2021-06-30 18:07:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8cfcf209520c02c6a330b54a12d8711e SHA-1: 98934f09f7befcceb47c7c3a39cef92975c45022 SHA-256: 3d6a932876f07cf003874ac069cf50d80b50b301f87cd569ba68b5bf6d301003
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains numerous embedded URLs that likely lead to malicious content or further infection vectors. The PDF structure itself is also flagged for duplicate object bodies, a common obfuscation technique in malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grossfamilyreunion.com/clients/0/00/00c8ca1d7e0432e0ca4c178cf0a97985/File/ruviwivinetekuliz.pdf
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/160b2f320bb8d2---50155522137.pdf
    • https://sckstone.com/wp-content/plugins/super-forms/uploads/php/files/1a75e5b96628331cac7bee9efad2c12e/tumifina.pdf
    • http://pointerboards.com/uploads/admin/files/87198716161.pdf
    • https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/cecf66335fa7880ff487bfe5f77b0320/9603953529.pdf
    • http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/16077c173a3a88---mumafomoku.pdf
    • http://archinfo.ru/uploads/file/juxugilabuxikuvavoda.pdf
    • https://xo-sound.ru/userfiles/file/fugarugofuwafa.pdf
    • https://www.ibyservice.com/wp-content/plugins/super-forms/uploads/php/files/374e61daa73833c46611661c1aeb325c/28482310262.pdf
    • http://khiconghoixuancong.com/Khicong/admin/userfiles/file/59537184381.pdf
    • http://ednak.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bdc2a1821d---6799454560.pdf
    • https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/s9d4gr4sfo3u52eifgdc94r090/gosoxoresobelukabegu.pdf
    • http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/vp8em0a66t0bouuiplts1593e7/360198186.pdf
    • http://eurogeographyjournal.eu/admin/fckfiles/file/giliwabopiwosuxom.pdf
    • http://www.ashtralmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087387d7149d---wonulab.pdf
    • https://asiatravel.kg/wp-content/plugins/super-forms/uploads/php/files/4c4d6e8faf35e2aef9d05eea26317a6f/59750435915.pdf
    • http://multiseal.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/160865d6c4898e---51985957051.pdf
    • http://broadmoor79.com/clients/864886/File/guvozizojofeposa.pdf
    • http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/759e02b09d4dcb19488050c509279c7a/giregubi.pdf
    • http://www.sandzthabapanel.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607bd5ca1f245---nogidonapa.pdf
    • https://camping-du-lac-dijon.com/fichiers/pekimojevojiko.pdf
    • https://intelean.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2343cdf1be---gotuvamawo.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=difference+between+student+learning+outcomes+and+student+assessment+tasks
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102d2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102D2 16792 bytes
font_01_sfnt_off00011ae4.bin
602ab1100812d5dd1ccef5fb32da6d6921c4a1854b2578ecf47de0da6de21d69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AE4 19560 bytes
font_02_sfnt_off00014ba5.bin
03b6e65d3bdb3b77b0702b7637119240a8e4d8bb83293b87f789e60b25b4ab73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BA5 11236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.