Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c76c5b1e9a2fc34…

MALICIOUS

PDF

87.1 KB Created: 2021-03-16 05:50:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 523979d5eed319b1481981c52b060ea5 SHA-1: da3b9b45e52d305b190be141426f0e1752f02d21 SHA-256: 5c76c5b1e9a2fc3430c9fe32541307b7003f366eac118d0ae61b9902bc3ade06
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL pointing to a suspicious domain, identified by heuristics and a machine learning classifier as malicious. ClamAV also detected it as a phishing trojan. The document body, though heavily obfuscated, contains keywords related to educational content, likely a lure to encourage users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=9-2+reteaching+quadratic+functions
    • http://pobasomitiji.22web.org/50593199779.pdf
    • http://tokesuditetu.getenjoyment.net/the_devotion_of_suspect_x_2017_english_subtitles.pdf
    • http://onlinetyz.xyz/spider_man_2002_download7djw4.pdf
    • http://serovakarara.mygamesonline.org/warisonemuladoridajofifik.pdf
    • http://onlyforyou.space/jetasitufituwukulojuxi5f83p.pdf
    • http://betmoy54.com/top_10_nigerian_praise_and_worship_songs1fsli.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jezaxojipevu/xekelukil.pdf
    • https://s3.amazonaws.com/wonumafubij/chemical_bonds_ionic_and_covalent_quiz_answers.pdf
    • https://s3.amazonaws.com/kakef/71855324126.pdf
    • https://s3.amazonaws.com/gebukil/sidemen_audio_book_free.pdf
    • https://s3.amazonaws.com/gawabog/gopro_hero_3_owners_manual_download.pdf
    • http://jejivosijej.rf.gd/sifigajaxisub.pdf
    • https://uploads.strikinglycdn.com/files/60552176-85d1-4ce2-a5f4-307d451cd2c8/pippi_longstocking_1969_full_movie_online_free.pdf
    • https://uploads.strikinglycdn.com/files/eb816653-fc3d-4e5e-aa05-42297480e795/int32_cos_x_23_cos_x2dx_is_equal_to.pdf
    • http://kimawawasero.onlinewebshop.net/legaf.pdf
    • https://uploads.strikinglycdn.com/files/eaf56c8e-36e0-40cf-a188-e302c1663e71/48529604935.pdf
    • https://s3.amazonaws.com/mogedozara/how_to_mod_medieval_2_total_war_on_steam.pdf
    • https://s3.amazonaws.com/veraxawewib/xewunojilox.pdf
    • https://s3.amazonaws.com/tobaziw/how_to_teach_culturally_diverse_students.pdf
    • https://uploads.strikinglycdn.com/files/94a3581e-0d2d-487f-8363-20dffa9ecf28/kumedosopisofuruxode.pdf
    • http://zefuziboveteg.epizy.com/hbsag_blood_test_report.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010004.bin
b09c96927f77ca9824d0941bd3f1cff992ebb3d47a812dfec7f04f3ac268100b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10004 5600 bytes
font_01_sfnt_off00011307.bin
3e94de4afe9bbc171c58e62b42a360e894a1282a4de1f9be08c57e1eb8719b9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11307 11372 bytes
font_02_sfnt_off000139d3.bin
69f36bcbbb2438f186f472b294e9dc012d9863b86530c17a86ab32e0c04331ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x139D3 16116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.