Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c76ec5a9134c68f…

MALICIOUS

PDF

69.5 KB Created: 2021-03-21 10:37:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc6c7ae95fd69f6d7cf15db275947fe6 SHA-1: 6ed50b197298dc9eac7cf39669c23199de5ea851 SHA-256: 5c76ec5a9134c68fddcf4410f534f7753a818952431823b8ea845a6bdab1b4b0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to host or redirect to a malicious payload. The document body, though heavily obfuscated, suggests a lure related to computer architecture exercises, aiming to trick users into visiting the external URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=ejercicios+resueltos+de+arquitectura+de+computadoras+pdf
    • http://vamolufu.getenjoyment.net/august_month_current_affairs_2020_in_tamil.pdf
    • http://copyrights-notices-helps.com/the_raven_remastered_ps4_review3v2sp.pdf
    • http://alcexpress3.xyz/gameshark_iso_ps2nwhhk.pdf
    • https://senamevab.weebly.com/uploads/1/3/4/6/134689233/raredisujobun.pdf
    • http://dkmz2.club/womufisetajorene7oh8s.pdf
    • http://furniture21.online/bojonibogikexekesigx12j.pdf
    • https://penaxixix.weebly.com/uploads/1/3/0/8/130813526/8a2813f0fa24.pdf
    • http://igonlinesupport.com/kuliguk7e60k.pdf
    • http://ninuxalezopo.getenjoyment.net/1074185701.pdf
    • http://siondez.ru/nutrition_in_pregnancygi7db.pdf
    • http://felagem.getenjoyment.net/wevumejukazuvaba.pdf
    • http://nuverlites.online/dujadupitatigmv228.pdf
    • http://tonilakifak.mypressonline.com/sc_st_atrocities_act.pdf
    • http://spindlndou.space/is_construction_hard_to_learnb3d8e.pdf
    • http://tehnopolis.org/singer_4452_heavy_duty_sewing_machine_walmartja3vf.pdf
    • http://zomolejefej.mywebcommunity.org/vamaxuzuseta.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c1cb471f-fc5c-4ef2-b3e1-4d0d0d09d135.filesusr.com/ugd/cc5b41_f883f11bf7264f8fa73e26940464a4f0.pdf?index=true
    • https://s3.amazonaws.com/vavale/first_aid_kit_sign_out_sheet.pdf
    • https://s3.amazonaws.com/vavapekadoliti/92898933950.pdf
    • https://27158da8-170d-48ca-a528-b8ced62fe517.filesusr.com/ugd/9fc8c3_7f0b9c17283549759caae234fc973a8c.pdf?index=true
    • https://s3.amazonaws.com/pisedij/how_long_is_paternity_leave_for.pdf
    • https://s3.amazonaws.com/tabobujimo/2012_taotao_50cc_scooter_parts.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d148.bin
32349eb8d45cfc7d3aa0c181e15a8ffc426ec4e08e14ea3654fa7038306c3799		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD148 5460 bytes
font_01_sfnt_off0000e3c7.bin
d51b6b012c9675e23c58eda1964615e8e4e5d005228689755fa8ff0faef9e4d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3C7 11136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.