Malicious PDF — malware analysis report

Static analysis result for SHA-256 60fa7a1a64c4395d…

MALICIOUS

PDF

101.3 KB Created: 2021-07-19 10:40:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 40a7d5424efafb52302f02ea31d2ef12 SHA-1: 412d9b9dfefb29ced115e8e0992d7001b9dcf16e SHA-256: 60fa7a1a64c4395d7c4f481e8f2bff958844f6714c8749e0215fba1b483969dc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier and ClamAV detection strongly indicate malicious intent. The PDF contains embedded URLs that, while many are confirmed benign, suggest an attempt to redirect the user to malicious content. The presence of PDF_URI and EMBEDDED_URL heuristics points to the document's role in a phishing or social engineering attack, likely as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7925

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/kVSxLQpkboc/square?utm_term=types+of+lease+pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ed366550bb312daecbbbee/1626158693299/wuvuriresoxomobojemalov.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ecc1e0ab13250a0546e24c/1626128864254/creepy_words_that_start_with_a.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e91555b630645a0ef6f8d7/1625888085642/48790670774.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f40b2981f38b20588db8ed/1626606378079/cool_lucario_wallpapers.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f047b8e4fb0f110d7fd799/1626359736948/carrom_pool_coins.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012979.bin
966ecb0f9d335719b41ce1f6a82dfb2101f7a65aebcaed60dd13d8f0d3102f6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12979 10176 bytes
font_01_sfnt_off0001406c.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1406C 16792 bytes
font_02_sfnt_off0001587e.bin
0abfc17f42cc44265b10a786cebd3b98b090d7ded41ba1cc1a4c36ac2542d134		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1587E 18384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.