Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a81daabb58769c6…

MALICIOUS

PDF

187.9 KB Created: 2021-04-04 17:28:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 48487c49df80b4eca63cf7b072844bdc SHA-1: dbf4ee2740fcf1212e738018ececa014f772693c SHA-256: 4a81daabb58769c677647ad36607db16aad8f8015953c80c4a4b36ebe41fa149
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. The document body, though heavily obfuscated, contains text that appears to be a lure for "Kcpe kiswahili 2018 answers", directing users to the identified URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9883

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=kcpe+kiswahili+2018+answers
    • https://cdn-cms.f-static.net/uploads/4402032/normal_603849d07ac5a.pdf
    • https://cdn.sqhk.co/kejofuvata/Wxgg8ik/pujogimak.pdf
    • https://dujekiwirole.weebly.com/uploads/1/3/4/2/134266498/kosinufiwi.pdf
    • http://witomemu.scienceontheweb.net/kuranuda.pdf
    • https://cdn.sqhk.co/wobuwaseja/dhigdjc/midejepizifusititanit.pdf
    • https://cdn.sqhk.co/zubuwebofe/heui89L/weather_apps_for_android_phones_free.pdf
    • https://jibunomo.weebly.com/uploads/1/3/5/3/135348462/memaluriworuvubizona.pdf
    • https://cdn-cms.f-static.net/uploads/4470985/normal_601dcb4d961ce.pdf
    • https://lodofimedama.weebly.com/uploads/1/3/4/3/134327961/9054247.pdf
    • https://jobeluke.weebly.com/uploads/1/3/5/3/135318189/3919093.pdf
    • https://cdn-cms.f-static.net/uploads/4390366/normal_600ee6e11006b.pdf
    • https://cdn.sqhk.co/tokafumotebi/ihcjez9/fruit_coloring_sheets_printable.pdf
    • https://fojaloda.weebly.com/uploads/1/3/0/7/130776233/kijameruvurawe.pdf
    • https://cdn.sqhk.co/fobonelaga/rhjXhjD/33669395844.pdf
    • http://ravigimojamel.mypressonline.com/victory_worship_chords.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/230f83e5-876d-49d5-bf97-1f5bddf66ec6/how_to_interpret_descriptive_statistics_in_research.pdf
    • https://uploads.strikinglycdn.com/files/fe79e645-51f7-4016-bc32-83a557d1d147/74468759785.pdf
    • https://uploads.strikinglycdn.com/files/ec1aaf7d-17fc-442c-b29c-53c85a5b83cb/wotowaxasiwozima.pdf
    • https://uploads.strikinglycdn.com/files/ca76932a-8480-427e-9c6a-02b335be0e3a/vesuz.pdf
    • http://vagimosaperijoz.epizy.com/business_plan_report_sample.pdf
    • https://uploads.strikinglycdn.com/files/5770be45-bfc6-4067-ad71-aec835169a18/63130095935.pdf
    • http://kibeloveze.rf.gd/faver.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00028e91.bin
310de8bbfca9d67f408d345717e035429e0bff5d74e474692c060a4ffebb2c29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x28E91 5664 bytes
font_01_sfnt_off0002a1f6.bin
7cbf2929b1bfdf0d8268793f11394c967938981dc16c81b8963dadf13f340f26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A1F6 11848 bytes
font_02_sfnt_off0002ca3e.bin
a2557213f5c4df2fc5234fe02c113942f57ea888816700d739dd5cccc5cb15b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CA3E 16324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.