Malicious PDF — malware analysis report

Static analysis result for SHA-256 5bb411393549afc1…

MALICIOUS

PDF

74.1 KB Created: 2021-04-01 01:03:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 78bf72a9007f9b969dba721b2413e22f SHA-1: c7ace665d73bcc47e0bfd0543572a25c6206969d SHA-256: 5bb411393549afc165158310db29ba6dd0186f49da2923b2e05d2a90e3f92df1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that redirects to a URL associated with a phishing lure, specifically offering a '400 must have words for the toefl pdf free download'. This, combined with the ClamAV detection of 'Pdf.Phishing.Trojan', strongly suggests a phishing attack. While no scripts were explicitly extracted, the PDF structure and embedded URI indicate a malicious intent to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=400+must+have+words+for+the+toefl+pdf+free+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4501794/normal_5fdf183124acd.pdfIn PDF document text
    • http://fufejezonodim.mywebcommunity.org/9449425468.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377912/normal_5fcfad0d79f2a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4498883/normal_6005b53c68ffe.pdfIn PDF document text
    • http://hookup681.site/taurus_g2c_9mm_gripsl8t1w.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387939/normal_605f63d9231fe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471114/normal_5fe8495bb0852.pdfIn PDF document text
    • http://copyright-notice-ig.com/19059504293orhv8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417808/normal_5ff0b01f7a5ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455890/normal_602b04feb7646.pdfIn PDF document text
    • http://pazefezos.mywebcommunity.org/analysing_architecture_free.pdfIn PDF document text
    • http://shoop-fg.ru/99852735716st4cu.pdfIn PDF document text
    • http://webmastervlad.ru/perception_of_academic_stress_scale_scoringd9o85.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4472216/normal_5fc7cf70058c8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481423/normal_6027eda6168c5.pdfIn PDF document text
    • http://gradstroy.su/92989613651v5c14.pdfIn PDF document text
    • http://rixuliketasaban.mywebcommunity.org/latutifemeramukenorodipox.pdfIn PDF document text
    • http://pedaxofanor.mywebcommunity.org/traductor_de_ingles_espaol_para_nios.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zirutabu.myartsonline.com/5528655544.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ab3235b-e042-4edd-bd91-f733c7a54575/formulas_para_hallar_el_volumen_de_los_cuerpos_geometricos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebd07bfa-cc57-4a7e-8e62-5c8b3222533b/el_sindrome_de_ulises_libro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33f529b3-a268-4217-93e2-92b68b9ebea0/canon_ip90_printhead.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a5d2f21-c6f3-4b3a-beed-c193a5317a96/sofinagofoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89145baa-3724-4cad-9858-6c61deca26a6/how_to_install_microsoft_project_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e150.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE150 5568 bytes
SHA-256: c600237a1563b8de5a679831a986f50ae245d35df5651e464d591bfce6b78678
font_01_sfnt_off0000f42c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF42C 11404 bytes
SHA-256: 40a083d8d0b0d1dde9043ad53891304ebcabd083a7c82b082556ad150d6dccf5

Open this report in the interactive analyzer, or submit your own file for analysis.