Malicious PDF — malware analysis report

Static analysis result for SHA-256 56e9281dd57133fb…

MALICIOUS

PDF

83.5 KB Created: 2021-07-16 08:39:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: d523b29ad552541860601e81e38b07ed SHA-1: f499d2d841479531e05670a77e45e08eb52e9d3f SHA-256: 56e9281dd57133fb6ad83984bf6f0ce2031e7822e99aa40cb0fe767f593b0099
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV specifically identifying it as a 'Pdf.Phishing.Trojan'. The presence of embedded URLs, although many are marked as benign, suggests an attempt to lure the user to external resources. The file's structure also indicates potential exploitation of PDF vulnerabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/u8n3KCQdUYc/square?utm_term=software+engineering+final+exam+questions+and+answers+pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edeb931f6a951228712563/1626205075998/why_a_file_is_not_opening.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60edf6579942ff19c769fc69/1626207831321/63288878517.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8bd621baabd329ba518b8/1625865570576/belixexesi.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f0d45c1d65320800974ba0/1626395741109/bumovenovufubif.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edd8cead58ca03d2264b0d/1626200270880/66929068179.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ee5ce5a005482cc1588846/1626234085565/heat_of_solution_experiment.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e87a2db7bae369529305f8/1625848365727/movie_streaming_app_for_android_tv.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee0019930ff80baa0f81e2/1626210329329/jolagativubagowaka.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f104e1f8313f2e5964cfdc/1626408161391/wuthering_heights_novel_free_download.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8d634ea5a3748ec5c796f/1625871924937/morerevamo.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e90ec6dc37083541b7fd32/1625886406891/wuwaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1f8.bin
fddb7a4ad036b0d48b9fcdff753471f8fe4827b77ca839318a744c3f4fa72b6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1F8 11348 bytes
font_01_sfnt_off0000fc37.bin
ceac1b5766eded4f7e2e98a8928637e1dc6f5fa1296ff69a9da5bcc7236e3fdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC37 17092 bytes
font_02_sfnt_off000128ee.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128EE 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.