Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fc218557ebf3309…

MALICIOUS

PDF

76.9 KB Created: 2021-07-16 07:42:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8eb7daa6bb27316f5c3e85e346faa150 SHA-1: 16f95b50b796dd3e7c2975d7b4547340eb5b6093 SHA-256: 3fc218557ebf330971c45d4421bafb45d6954f40aa8a6ffe43c91e5bd5235c2b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged as malicious by both ML classification and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs, though many are marked as benign, suggests an attempt to lure the user to external resources. The file's structure and detection patterns align with common phishing or malware distribution techniques delivered via PDF attachments.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9125

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/9xivtwLAy4k/square?utm_term=how+to+send+pdf+to+email
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e7fcb438ed220952aef924/1625816244774/limovaperepok.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60eddc7dafeffb59e671ccaa/1626201213633/the_holy_blood_and_the_holy_grail_free_download.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60eda73b5e50ea0df8e1079a/1626187579704/wetabofolopidujumafog.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f0a00566e9a80e0667ece8/1626382341633/tupac_me_against_the_world_mp3.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60efcc653a4e3014a1c10326/1626328165648/ms_sql_group_by_count.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccd7.bin
3429f9e7b51916efbc9d4fb59700cefd4b0f7cd0665cbc3d0d4daf86dadc04e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCCD7 10636 bytes
font_01_sfnt_off0000e531.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE531 16792 bytes
font_02_sfnt_off0000fd43.bin
89fd2683bf273e040260da01f41e10109c6548bb213290d1a8d06e5376edd440		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD43 16436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.