Malicious PDF — malware analysis report

Static analysis result for SHA-256 549e65326d06bd22…

MALICIOUS

PDF

76.9 KB Created: 2021-03-27 10:07:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 830884c2e3ef46c232b8ad1ff5e25ed0 SHA-1: dffdcc10bcb5d74789ca8c82d278bb66270f99df SHA-256: 549e65326d06bd224a9b0a4157d35053728e826722ee738470116ece8b31a158
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that directs users to a URL associated with a search query for 'photomath pc windows 7', suggesting a phishing or scam attempt. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=photomath+pc+windows+7
    • http://good-production17.site/xuvowimabaxuwawuwuiwvoa.pdf
    • http://verifiedbadge-lnstagram.com/tough_solar_g_shock_reviewdurs6.pdf
    • https://cdn.sqhk.co/kagurase/ghcXqgd/smash_hit_all_characters.pdf
    • https://cdn.sqhk.co/fuluzagile/igZhexX/56742347939.pdf
    • http://mojenisijita.mywebcommunity.org/math_formula_in_hindi_free_download.pdf
    • http://rapiwanijisage.scienceontheweb.net/sadawegumur.pdf
    • http://budokudepa.scienceontheweb.net/94109749919.pdf
    • https://cdn.sqhk.co/latipizi/SDM3Wjw/7477113355.pdf
    • https://cdn.sqhk.co/fuludasowipu/t2heTZE/sanolipomoruvijigeredevul.pdf
    • https://cdn.sqhk.co/nivodoruw/5diot2u/microsoft_planner_vs_trello_2019.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fubavinexazixo.onlinewebshop.net/simple_and_clean_piano_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/776050b5-20f8-4f5d-822c-52f4a8675e31/jisok.pdf
    • https://ac614e2c-2e00-43e4-a80f-2c6bce9fb64b.filesusr.com/ugd/f103bb_92fe66a48b914738a3f1f6967f02a148.pdf?index=true
    • https://8ac5c8e1-9174-427d-95c2-90bebb9f105a.filesusr.com/ugd/44b221_b4a3bf8b42f1483ca69cc675fcc33b71.pdf?index=true
    • https://s3.amazonaws.com/bubodeliza/the_dance_garth_brooks_piano_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/2b9bfd25-a057-4e5d-891a-a3baa3b04a29/books_for_9_year_old_boy_advance_reader.pdf
    • https://s3.amazonaws.com/setigafat/is_chinese_grammar_hard.pdf
    • https://s3.amazonaws.com/mukut/samsung_a10_mobile_photo.pdf
    • https://s3.amazonaws.com/mipeboro/bounty_rush_apk_data.pdf
    • https://uploads.strikinglycdn.com/files/2720ead2-2d0e-4513-ad08-2295bdf9cbbc/olympus_vn_7200_download_to_computer.pdf
    • https://uploads.strikinglycdn.com/files/fc37df5b-2609-4c09-814b-d99df128604f/dell_latitude_e6430_i5_battery_life.pdf
    • https://f538c46d-6aff-4997-95da-320e40b30403.filesusr.com/ugd/262ba4_6ac76d1f89744b03985d1de682a212b5.pdf?index=true
    • https://d67926d6-99fe-48a4-938f-95006fdf2de6.filesusr.com/ugd/21d82e_c5d62e5241034c358305e5b1765a785f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d164340f-76fd-40b3-9e5f-e0d1f7d02728/cat_in_the_hat_original_book_cover.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb30.bin
92be4b6a45156745c8cf2b8f833464ca5c4b3e88ff50d19f98b34404647be61a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB30 5356 bytes
font_01_sfnt_off0000fd58.bin
b4b63399d48a557180493acb7e85c9e1951b2c625ad6bfd4765febd849525bae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD58 12244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.