Malicious PDF — malware analysis report

Static analysis result for SHA-256 6322a20ee3ff10da…

MALICIOUS

PDF

81.0 KB Created: 2021-04-05 05:27:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd49a54e47e63b8432245c28ce645dd2 SHA-1: d9b9b66fb82aee10c4d71f0fcd2bb0ea3377b2a5 SHA-256: 6322a20ee3ff10da6ad6eaf65066c56474771e248c794d3fa3e60695a2068402
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, with a high risk score. It contains an embedded URL that masquerades as a 'polynomials word problems worksheet answer key', likely a lure to trick users into visiting a malicious site. The presence of multiple unknown URLs further supports the phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=polynomials+word+problems+worksheet+answer+key
    • https://cdn-cms.f-static.net/uploads/4466161/normal_60226ee62543d.pdf
    • http://zegererevez.medianewsonline.com/rojile.pdf
    • https://cdn-cms.f-static.net/uploads/4385848/normal_605692d93053e.pdf
    • http://fedexonep.mypressonline.com/nokiwulenakolijunile.pdf
    • http://216tilford.com/vofepixabubo7bj6.pdf
    • http://funasowuto.getenjoyment.net/59926531928.pdf
    • http://gejurabek.getenjoyment.net/learn_forex_technical_analysis.pdf
    • https://cdn-cms.f-static.net/uploads/4473637/normal_600b95c4c38c1.pdf
    • http://gagivukamuw.getenjoyment.net/58996337171.pdf
    • http://tigibisolefora.mygamesonline.org/99073077808.pdf
    • http://world-wildshop.com/rimojovokopunl.pdf
    • http://smeshnoykir.space/ximup8cpm3.pdf
    • https://cdn-cms.f-static.net/uploads/4454042/normal_60259b75b42af.pdf
    • http://zezasarasojid.mywebcommunity.org/59056955851.pdf
    • http://lordtrans.ru/rogue_galaxy_walkthrough_gladius_towersq7z40.pdf
    • https://static.s123-cdn-static.com/uploads/4475716/normal_5ff65447543ad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fdb3ac18-2625-4a79-a1ba-79ceac1d76bc/fibup.pdf
    • http://wonitijaxexilo.rf.gd/continuidad_de_los_parques_julio_cortazar.pdf
    • http://mibovemijo.rf.gd/jeffrey_gitomer_biblia_handlowca.pdf
    • http://wutasudi.epizy.com/input_type_file_accept_application.pdf
    • https://uploads.strikinglycdn.com/files/10bb7662-dc94-4c31-92ea-4bff389eddf9/dutupewo.pdf
    • http://rinikebamujigiz.rf.gd/3d_maker_for_inventor.pdf
    • https://uploads.strikinglycdn.com/files/53c345d9-5c4a-4d09-9b13-c30d5abbb32a/what_type_of_oil_does_a_2012_hyundai_sonata_use.pdf
    • https://uploads.strikinglycdn.com/files/51bc4291-77fd-44b0-bed9-91ea69a53021/oil_filled_radiant_heater_safety.pdf
    • http://fipunagofalava.rf.gd/the_best_knots_to_know.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fda2.bin
367d08c5224f1b215555789bae140cfaea858320abbff6731a38db3fd7e02088		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDA2 5600 bytes
font_01_sfnt_off00011088.bin
c93d559271bb37bb997a986851100d8a60dba66c27c33f33c2aab0032df3db87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11088 11084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.