Malicious PDF — malware analysis report

Static analysis result for SHA-256 578b2020a68f6f8a…

MALICIOUS

PDF

101.2 KB Created: 2021-06-01 02:06:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 27d11922403f5efdea6b4dc6454c4a0e SHA-1: ec77907332f5516b12713e00ff4f3d0fff070b77 SHA-256: 578b2020a68f6f8aec00221df636dab116ce4ee3b05559c3171cbb571d70e065
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. ClamAV detection and ML classification strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, appears to be a lure related to real estate licensing exams.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=real+estate+license+exam+for+dummies+pdf
    • https://static.s123-cdn-static.com/uploads/4412902/normal_5fe46fbf33360.pdf
    • https://cdn-cms.f-static.net/uploads/4490125/normal_5fd7f7d446cd2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bojirakaj.pbworks.com/f/batla_house_full_movie_download_filmywap.pdf
    • https://uploads.strikinglycdn.com/files/a2f361fb-d7f5-4a6c-bbe9-a79220d8b095/43531455796.pdf
    • https://uploads.strikinglycdn.com/files/9088ae07-985d-42cb-b386-7f39b640b184/how_long_does_a_milwaukee_2.0_battery_last.pdf
    • https://uploads.strikinglycdn.com/files/a3607166-9e3f-47bb-9c0c-1ba935125094/xpress_m2070w.pdf
    • https://uploads.strikinglycdn.com/files/899d6cc1-08d1-4de5-9347-8fe19a1e59b9/14868320779.pdf
    • https://uploads.strikinglycdn.com/files/780601d1-5305-4fb8-a9b0-30e5ac587cd8/5520118126.pdf
    • https://uploads.strikinglycdn.com/files/249cc89c-ef62-4e9d-85ea-f151af99f957/3682006676.pdf
    • https://uploads.strikinglycdn.com/files/b5899917-4f7d-44bc-ad2c-aca0367b72f9/medical_spanish_translator_salary.pdf
    • http://poforezufovu.pbworks.com/f/tinaxadizinowemajogug.pdf
    • https://uploads.strikinglycdn.com/files/a85d2ab3-146f-4b7c-b93b-c5bb868858cc/como_crear_un_en_iphone_x.pdf
    • https://uploads.strikinglycdn.com/files/47c81585-d29a-477b-9f4e-b179cca60f39/83064288562.pdf
    • http://supatibu.pbworks.com/f/hungry_dragon_hack_apk_1._11.5.pdf
    • https://uploads.strikinglycdn.com/files/c4390316-c224-4184-a4f1-bf3c1f61ab5e/timex_expedition_chronograph_how_to_use.pdf
    • https://uploads.strikinglycdn.com/files/f0f16c74-e92e-44bc-bd6f-b4c0d3c24871/88091065247.pdf
    • https://uploads.strikinglycdn.com/files/beac9ba5-a784-4c02-892f-cfd657536734/the_heros_journey_book.pdf
    • https://uploads.strikinglycdn.com/files/81fd0293-4817-4e6d-9ccf-69d68e73b317/jakowozovomizafilagu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015080.bin
f85a757c99cc3aebf3a8388eb68fa512d1647cd2e9e291c3147c0cd125075e9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15080 5376 bytes
font_01_sfnt_off000162c0.bin
4a39859c532fe9fcf698db1e08236b18a997209f14cabb9e17626201515cf39a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x162C0 10680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.