Malicious PDF — malware analysis report

Static analysis result for SHA-256 4aee7d0fe14e4d70…

MALICIOUS

PDF

68.6 KB Created: 2020-12-18 04:07:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 56fdc8e4372747600aab1794ef87d807 SHA-1: ed0661fbaff33fc2c9982ecc5cb50968f5f65bcf SHA-256: 4aee7d0fe14e4d701655d45fd85bc4e2d9d4f4c6f0061a1e2cdca7ca9f882024
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by ClamAV and a machine learning classifier as malicious. The document body, though heavily obfuscated, suggests a lure related to 'Arduino ide programming pdf', likely intended to trick users into visiting the malicious URL. No scripts were extracted, but the presence of an external URI and high confidence malicious classification indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=arduino+ide+programming+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/salade/wuzolok.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc56d932cf09257bd8a04eb/t/5fca0ff42ae1264a03989dc2/1607077877531/fezexorepudix.pdfIn PDF document text
    • https://s3.amazonaws.com/bokofapig/makogedetokalu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc3612fc6229360ecbcc3d9/t/5fc415d8eaf37e3b641c7fe9/1606686169710/foxface_hunger_games_name.pdfIn PDF document text
    • https://s3.amazonaws.com/sedimeraxufi/tratamiento_para_la_anemia_aplasica.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10ac260f2895dc1e8a19d/t/5fc149a83485235c86f65571/1606502825850/toledo_technology_academy_schedule.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc11355ab79f442f22aa123/t/5fc153c1e6d49a06bbc3876f/1606505410659/all_in_learning_sign_in.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf693f3de5e49b529d971/1606284955846/simbologia_electrica_residencial.pdfIn PDF document text
    • https://s3.amazonaws.com/bexolamabad/childminder_registration_form.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2c0e99955c744b5478b1e/t/5fcd2d6aeb18547f4b8e0515/1607282027035/blackpink_songs_list_lyrics.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc285ac5e8e827d42982ab0/t/5fc3ecb73485235c863f6fb4/1606675639672/35388563656.pdfIn PDF document text
    • https://s3.amazonaws.com/jopomodilamego/jaspersoft_studio_report_parameters.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2b03bbd14ff0dd2a824dd/t/5fc519eb18e72e5fdb7a557a/1606752748004/zewisid.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0ba71e9fc3622d52139a6/t/5fc0f619e18c5c478e1e6e84/1606481435381/mudiriluzavularoxeriwize.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc792d6717a0f60c4041ff2/t/5fc8c51ddcb5b2607983b0ba/1606993182203/bagel_sandwich_recipes_vegetarian.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/ejercicios_movimiento_rectilineo_uniforme.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d173.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD173 5140 bytes
SHA-256: f7886c6eab597574d37c69fb2ce2d02c4b4c34bff707e11e51eb654eb9bc5bd6
font_01_sfnt_off0000e2e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2E3 10192 bytes
SHA-256: b3cbbf2a1cce12aba1fcc23a5ffa40315126235c0bb8ca4f0f21c9e0b3cc4ff7

Open this report in the interactive analyzer, or submit your own file for analysis.