Malicious PDF — malware analysis report

Static analysis result for SHA-256 5321daff7c866238…

MALICIOUS

PDF

103.7 KB Created: 2021-02-28 18:38:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c8369d734190d83cb616cf148011fff SHA-1: b0d19a5e8d260f07abb78ce4ca5fb02dfac94850 SHA-256: 5321daff7c8662383c9d4502e840a64acb314335a32641d533a812ff9c66b4ae
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be a lure related to 'The Outsiders' book, suggesting a targeted phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=the+outsiders+chapter+7+quiz+answers
    • http://thedouche.xyz/crazytalk_animator_3_free_full0n9go.pdf
    • https://cdn.sqhk.co/kufalavoxig/r7hiv6x/43835496036.pdf
    • http://raguvigawak.mypressonline.com/watch_jack_reacher_2016_movie_online.pdf
    • https://cdn.sqhk.co/kekotenonaxu/TgigAif/60235637137.pdf
    • https://cdn.sqhk.co/pigevikuwi/chb9jiw/dragalia_lost_twitter_japan.pdf
    • https://cdn.sqhk.co/romilononove/hdkXien/how_to_get_extreme_speed_dragonite_heartgold.pdf
    • https://cdn.sqhk.co/jivapereb/wCpggia/81647310227.pdf
    • https://cdn.sqhk.co/tememukafosu/V5jchaI/texas_war_of_independence_from_mexico.pdf
    • https://cdn-cms.f-static.net/uploads/4380211/normal_602f4551874b8.pdf
    • https://static.s123-cdn-static.com/uploads/4408599/normal_5fed1b477f31a.pdf
    • https://cdn.sqhk.co/bozawenibiwa/hiChdX0/track_phone_number_free_app.pdf
    • https://cdn.sqhk.co/mivuxakadu/C6nduij/penalty_kick_movie_trailer.pdf
    • https://cdn.sqhk.co/gitovera/jfoFumE/gapojuravumovejewarefire.pdf
    • https://static.s123-cdn-static.com/uploads/4458837/normal_5ff69191b81ab.pdf
    • https://cdn.sqhk.co/tatidukigag/g6hjNif/77573984272.pdf
    • https://cdn.sqhk.co/sozodumupof/hhgYchd/inside_out_2020_lineup.pdf
    • http://mowefopovog.mywebcommunity.org/41984370646.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nozozuwovore.atwebpages.com/retovevirakoba.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa40.bin
4f476926bd43f11e674f328ce5626754f883f6d636d9aecfe054f41bf81d1593		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA40 6624 bytes
font_01_sfnt_off00010a8d.bin
9554a5fdcc7a27eb336d076aaeb4e6d30332275e4366784ec6a213f987449a48		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A8D 3608 bytes
font_02_sfnt_off00011755.bin
55c63a4fa7390b762bc1e35f7b24f922e7900e04e2702ccdf2ff83854b5ab122		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11755 5424 bytes
font_03_sfnt_off000129a2.bin
2487ed0d0b1db77f07b82d1a53c06f3b3bf7399ba9cd18472a40a25c06c87b4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129A2 6436 bytes
font_04_sfnt_off00013949.bin
fbf0f78fbeeab7b1feaf979b8a6880b16d5d9e1e57fd52f40da7e09053cc8f57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13949 13512 bytes
font_05_sfnt_off000166a4.bin
0fd50ac29f0bace181aa53cd3a0be1160c0575fdaa4230ea8888719fdb254a61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166A4 17164 bytes
font_06_sfnt_off00017f8c.bin
5d7cb56ceb038b1043909d0769bb3c5b82de614e8ba6823f896114e511f7c570		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17F8C 6528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.