Malicious PDF — malware analysis report

Static analysis result for SHA-256 55f31c367dd40e2b…

MALICIOUS

PDF

79.1 KB Created: 2021-03-14 13:06:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d5715ab4a0651bd03414e1794fb745a6 SHA-1: cef2a7bf9238319705a5d19b4d2cce835ef363ad SHA-256: 55f31c367dd40e2b2eafa336c1250ac0590ecaecdee7710766a9d3ffdca7f2f5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a URL that impersonates a service for academic answers, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=chegg+answers+free+reddit+2019
    • http://batmbatm.ru/tracfone_lg_premier_pro_plus_caseomvk0.pdf
    • https://cdn.sqhk.co/bojowagawire/iIy9qji/ladubewifuli.pdf
    • https://cdn.sqhk.co/jenireni/bMjf0jd/75443305083.pdf
    • http://support-copyrighthelpservice-about.com/179475902629ix8e.pdf
    • http://tiktokcopyrighthelpteam.com/walmart_inventory_dayeygvd.pdf
    • http://netewe8.xyz/lewazitiziputatobimatedk2768.pdf
    • https://static.s123-cdn-static.com/uploads/4496571/normal_5fcbee02cbabd.pdf
    • https://cdn-cms.f-static.net/uploads/4402262/normal_5fd27b2a4ff0d.pdf
    • https://cdn.sqhk.co/bekutojeke/4gghgge/mario_chess_set_walmart.pdf
    • https://cdn-cms.f-static.net/uploads/4464529/normal_6023c993d5aa1.pdf
    • http://securityverifiedservices.com/4505841025u7ipg.pdf
    • https://cdn-cms.f-static.net/uploads/4365549/normal_603736fe5c3f5.pdf
    • http://hookup153.space/travel_reports_a127w77pc.pdf
    • https://cdn.sqhk.co/jinavefajevo/jaP3ieA/manerad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8eeb1f0a-0cdd-4c66-98a4-83777b49fb54.filesusr.com/ugd/64f9d2_020ed4125bd5489292fdf72fba8b7f18.pdf?index=true
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_915e67c60226438f9edbbfb80f6eb964.pdf?index=true
    • https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_b52df599eecb4bba8f179267d2ff8050.pdf?index=true
    • https://uploads.strikinglycdn.com/files/432ae4f1-d845-4097-9e78-a65ed3671702/computer_hardware_engineer_salary_per_month.pdf
    • https://uploads.strikinglycdn.com/files/67fdb1eb-876d-4cda-a581-5eff3b1849fa/3853986626.pdf
    • https://6c8027e1-9878-41b3-a9ef-32ba2b6bcd02.filesusr.com/ugd/185811_5919f0c479af4e12a0182ab476ae16db.pdf?index=true
    • https://99516632-72ce-40f3-a9a1-a01c91361c65.filesusr.com/ugd/e42c35_823a5c0323464485b7a2ab8c0071b175.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4ef.bin
fe3380e7f26a3d2d321038fbc55c51b3cd1dce1528e7c1bc75d63b4180a08bfd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4EF 5616 bytes
font_01_sfnt_off00010811.bin
b908856be5e930c79abbd0118c445d3f8080d4d282575a9ee119ae2e9be203e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10811 11824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.