Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c4e17478e5f61f7…

MALICIOUS

PDF

82.1 KB Created: 2021-07-17 17:57:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: a7c4ddb36053bd4284ab4603d9f2fca6 SHA-1: e850689fa42f81dfb6d51f5a308f1e98693bfda4 SHA-256: 5c4e17478e5f61f78b08457a1b1dc3bbdb032d2e6459eddf63877bc346d0e60c
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected by ClamAV as Pdf.Phishing.Trojan, indicating a phishing or trojanized PDF. The presence of embedded URLs, though marked as benign, suggests an attempt to lure users to external resources. The PDF structure also shows signs of object duplication, which can be used to hide malicious content.

Machine Learning

  • Nyx PDF Classifier clean score 0.1542

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/UkUWPC8UKDU/square?utm_term=free+indesign+magazine+templates+projects
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee28530a53c127f5d7280d/1626220627647/72022174367.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ed97ca7c55557fb27cbdda/1626183626764/18241556910.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000defb.bin
ce5502b1ede302ce1ef8a510a322f7f16b746fe2c1015e41db0ef97110e5ef64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEFB 16964 bytes
font_01_sfnt_off00010b51.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B51 16792 bytes
font_02_sfnt_off00012368.bin
1219bf73edc7ec1d693827c52d458509c5100dd02682ebb2eb379f8678604c96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12368 11024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.