Malicious PDF — malware analysis report

Static analysis result for SHA-256 498e79fb1904785c…

MALICIOUS

PDF

90.9 KB Created: 2021-04-03 21:42:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4528b2bd5ed9c05d32aac30ea9fda838 SHA-1: db88712781a30642c94f2e2c2448d527a2dad095 SHA-256: 498e79fb1904785ce2aae921ab29a8847f4fd0369972d7aeae5407c5c9c6bb33
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified as a phishing attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, contains keywords related to educational materials, reinforcing the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=o+level+zimsec+biology+syllabus+pdf
    • https://cdn-cms.f-static.net/uploads/4404515/normal_6033b83903125.pdf
    • https://cdn-cms.f-static.net/uploads/4448103/normal_603ab9ed3c7ae.pdf
    • https://cdn-cms.f-static.net/uploads/4443610/normal_5fd9b9e29863a.pdf
    • https://cdn-cms.f-static.net/uploads/4459629/normal_600a6a8b89db3.pdf
    • https://cdn-cms.f-static.net/uploads/4470017/normal_6052d02ed60fa.pdf
    • https://cdn-cms.f-static.net/uploads/4389365/normal_6056e58f73384.pdf
    • https://cdn-cms.f-static.net/uploads/4413702/normal_6027102319169.pdf
    • https://cdn-cms.f-static.net/uploads/4380229/normal_601fca7aea949.pdf
    • https://static.s123-cdn-static.com/uploads/4483082/normal_5ffe97e7932ce.pdf
    • https://cdn-cms.f-static.net/uploads/4423431/normal_5fe86baf364cf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/936413cc-1828-4f77-9562-37e07fbfcd2b/fallout_4_pc_mods_on_ps4_tutorial.pdf
    • https://s3.amazonaws.com/gavobawum/37209269583.pdf
    • https://s3.amazonaws.com/lopadivupudexa/photoshop_tutorials_photo_effects_in_hindi.pdf
    • https://s3.amazonaws.com/xixonu/86551792403.pdf
    • https://uploads.strikinglycdn.com/files/336f32d4-ac46-41d7-a5dd-f030975b807a/wupefoxijetuf.pdf
    • https://uploads.strikinglycdn.com/files/729e1d92-d5d8-44c7-964b-ad3f87040f21/rosary_prayer_guide_with_litany.pdf
    • https://s3.amazonaws.com/wovigebi/uc_browser_for_windows_7_filehippo.pdf
    • https://uploads.strikinglycdn.com/files/5aa67507-3e7a-4cbb-b5ce-a7c5e6b11d38/18944132301.pdf
    • https://uploads.strikinglycdn.com/files/8bd520e8-c4d5-4b82-9bd9-7a40ede51734/31859748743.pdf
    • https://s3.amazonaws.com/kifutizijebuj/21271420847.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000116f9.bin
9351bfdc6b69d4578ac504b2ed6d418da1b38678de893c33b43b41bffbf9cdea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116F9 5456 bytes
font_01_sfnt_off0001299d.bin
bea66606d99207bd523270273a9051e6e599938bbce4120e739423a77c5bfce1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1299D 11456 bytes
font_02_sfnt_off00015048.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15048 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.