Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e070487d9c3c4c7…

MALICIOUS

PDF

83.6 KB Created: 2021-07-21 17:55:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: d9beff273ea52945c2632e9b8a067a65 SHA-1: a3d7a8ae9d515543cdb890ad5a7edb73bc724593 SHA-256: 3e070487d9c3c4c77341c0321f93ff31fab6f519aa1ee7d7cabf338c41e63afd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a phishing or trojan-like behavior. The presence of embedded URLs suggests an attempt to redirect the user to malicious sites or download further payloads. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/ZV5PD9BTPXI/square?utm_term=dinesh+companion+chemistry+class+11+pdf+free+download
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f52abce13ee976661da3a9/1626679997008/how_to_edit_free_software_download.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f2c16c9ee5897bff9b90dc/1626521964805/ffbe_war_of_the_visions_global_mod_apk.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f791993d50763cde6c034a/1626837401702/nawadesejevifefasaf.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e923726e267257943aeb10/1625891698699/62470105558.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e7ab3b1d61f435cef55621/1625795387718/fallout_76_starting_tips.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec92cd8c19ad4998dc3c9f/1626116813639/how_to_save_a_trimmed_clip_in_imovie.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edffce172ba47bdac76250/1626210254234/strawberry_blonde_james_cagney.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f22cee27519501fc05ea3b/1626483950635/revising_in_the_writing_process.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e91f973ba7d954d54624ff/1625890711463/icd_10_anaplastic_large_cell_lymphoma.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60efdb421e1a563dfb8c5611/1626331970107/35075608654.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f06ed4f3478d215cea56cd/1626369748589/middle_earth_strategy_battle_game_battle_companies.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edd978ad58ca03d226547f/1626200440375/wuduxixoko.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f772e38a184f420728c786/1626829540086/when_driving_on_a_dirt_road_you_should.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f70f133cc4da3e86bada3e/1626803987769/gozifafufofofev.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f0a9c92d689d6a7ff2fb22/1626384841491/2700_dollars_in_rupees.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8f75cfc46b15058264f34/1625880413002/33004738364.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f1e7436cc3a66bf95c3453/1626466115422/dr_mitchell_ophthalmologist.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f8163f6c9f8c433247182d/1626871359965/pobosekusumazifadaseloba.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f63aa22e93dc7e95b50087/1626749602701/47830132086.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f2585aac778402356156f6/1626495066260/84353893603.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f6a6c4be9eb8768f0ceaef/1626777284323/pedagogy_meaning_in_english.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df02.bin
8affd428ee399d1dd38db52d4cd7f92875bac60e8b52e25e7c7306182c286f07		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF02 17320 bytes
font_01_sfnt_off00010c92.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C92 16792 bytes
font_02_sfnt_off000124a9.bin
cd2c804b75da558e81d221300e9c49c174f0a2f40b8071479049effc7ee1e439		 pdf-font-stream PDF embedded font (sfnt) at offset 0x124A9 11136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.