Malicious PDF — malware analysis report

Static analysis result for SHA-256 64c6c6509a462a26…

MALICIOUS

PDF

94.9 KB Created: 2021-07-18 12:33:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 66c84d4959fe4d6d36ead149bff55513 SHA-1: e3b874cae9edb6c7289713526f2115f8e05b7670 SHA-256: 64c6c6509a462a26f171c73766f7c4cf4213dcdf080220128a65b0541e191d03
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of embedded URLs and the 'Pdf.Phishing.Trojan' detection suggest it is used for phishing attacks. Although no scripts were explicitly extracted, the PDF format can embed JavaScript for malicious actions.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6187

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/pL_UGxDroB4/square?utm_term=what+are+some+karate+moves
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f1a148675fb4239daf65a4/1626448200302/62936688415.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f09d76dc83225f8cae6380/1626381686560/73021719691.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e91d1f1448b06198485919/1625890079456/parallel_and_perpendicular_graphs.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001129d.bin
0855e0413376df941d5b7e603174757eb3e14ba22e4c161a8709b16674af924f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1129D 17468 bytes
font_01_sfnt_off0001407f.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1407F 16792 bytes
font_02_sfnt_off00015896.bin
0f59d32f838e3804416abf1ce112ef394740a0d1342b51c144bbf288d311c163		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15896 10280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.