Malicious PDF — malware analysis report

Static analysis result for SHA-256 57d6c82eae8baa09…

MALICIOUS

PDF

92.5 KB Created: 2021-03-23 21:18:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4af4a47d12e2f72cdc9b77dd1a68a458 SHA-1: 2922d2125b04cb5a6b779ffcf4f149824803aa56 SHA-256: 57d6c82eae8baa0966a4ed0729709fdf1b3bac7369dd273e5ee54ad06dd02b48
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to 'https://dafemum.ru/award?keyword=toefl+pbt+sample+test+with+answers+pdf', which is likely a phishing lure. The document body, though heavily obfuscated, suggests a theme related to TOEFL tests, reinforcing the phishing pretext. No scripts were extracted, but the presence of external links and the ML/ClamAV detections strongly indicate a malicious intent, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=toefl+pbt+sample+test+with+answers+pdf
    • http://pixelbarista.com/attack_on_titan_season_4_trailer_subbedklsxh.pdf
    • https://tomavibevojivow.weebly.com/uploads/1/3/4/0/134016690/8094653.pdf
    • https://nererudufujodu.weebly.com/uploads/1/3/4/3/134321338/diduvoze.pdf
    • https://static.s123-cdn-static.com/uploads/4474985/normal_5ff4dd4c4fe67.pdf
    • https://sovokuragul.weebly.com/uploads/1/3/2/8/132814371/sozatadomes.pdf
    • https://rifodajawu.weebly.com/uploads/1/3/0/7/130739776/lazosafapuv_kegenaxes_zodujoxub_sarupopikopo.pdf
    • https://static.s123-cdn-static.com/uploads/4457847/normal_5fc89f256c2de.pdf
    • https://static.s123-cdn-static.com/uploads/4471275/normal_5fe5ba2405763.pdf
    • https://cdn-cms.f-static.net/uploads/4475217/normal_60163c4f15d73.pdf
    • https://mitumeme.weebly.com/uploads/1/3/4/8/134879381/1394847.pdf
    • https://boxavukexuzar.weebly.com/uploads/1/3/0/7/130775797/bolumu.pdf
    • https://cdn-cms.f-static.net/uploads/4427093/normal_600b783c854b0.pdf
    • https://xolijusir.weebly.com/uploads/1/3/4/0/134016651/723184.pdf
    • http://notdull-eng.online/video_minimizer_apkd358c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/juvetaso/chamsys_software_free.pdf
    • https://s3.amazonaws.com/rafiralexezol/how_to_write_an_essay_outline_apa_format.pdf
    • https://uploads.strikinglycdn.com/files/023f6772-62a3-42c9-a362-440a4dc1b7a2/xebubizonil.pdf
    • https://uploads.strikinglycdn.com/files/8817f05e-e8b9-4e18-a5a0-875977ecbd63/nike_air_force_1_shadow_se_particle_grey.pdf
    • https://uploads.strikinglycdn.com/files/447f9123-b634-42ae-9fb9-ee105d1f74c2/loving_and_forgiving_lyrics_by_scott_soper.pdf
    • https://uploads.strikinglycdn.com/files/f8b0cf6a-49c0-41ac-83d7-b56b8d043afb/vezobejijerukilorajububus.pdf
    • https://s3.amazonaws.com/fixararololu/rosotezajutafefuba.pdf
    • https://s3.amazonaws.com/getizar/king_lear_plot_summary.pdf
    • https://uploads.strikinglycdn.com/files/6b071df7-6f41-4e0a-b272-fb3c764b389c/malelolesemusopisol.pdf
    • https://s3.amazonaws.com/senodiw/naruto_games_free_for_gba.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012ada.bin
4d307a56cd3f23c1ccd65ffb465fdaedb7edabb0b19f88c41988609d48b589d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12ADA 5460 bytes
font_01_sfnt_off00013d48.bin
ef30dce863362469994e6c4240f5f284634886d0c8ec792c96f3f8ea8412117f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D48 11516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.