Malicious PDF — malware analysis report

Static analysis result for SHA-256 678019095befe47d…

MALICIOUS

PDF

72.2 KB Created: 2021-03-10 22:46:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 87096652e1737c4889db20eee827f2ea SHA-1: 4eaff7230dce7bafa6bd853650f59fb3c4d9605e SHA-256: 678019095befe47d2d4256418295e5ed1084d2b6dc0ce88d58acfdf609cfad62
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that appears to be a phishing lure, disguised as a search query for 'dana elementary school columbus ohio'. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URI are indicative of a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=dana+elementary+school+columbus+ohio
    • http://websporizle4.com/tabimasavetuminafuga4tgnk.pdf
    • http://rodsfish.club/bavefupekagoxipivaj3t0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e4d4bc56-7028-4c67-bb91-92e83ef244b7/4878595383.pdf
    • https://uploads.strikinglycdn.com/files/9fb200f2-1cca-4d97-9768-22f759a87512/how_to_write_slope_intercept_form_into_standard_form_or_vice_versa.pdf
    • https://uploads.strikinglycdn.com/files/b641a1d0-70f9-479a-b871-f183cf67d184/is_the_movie_big_short_based_on_a_true_story.pdf
    • https://uploads.strikinglycdn.com/files/543e6936-2388-480b-8527-73d4c0778681/coleman_hot_tub_error_message.pdf
    • http://gagaresereveku.epizy.com/the_play_opens_antigone.pdf
    • https://uploads.strikinglycdn.com/files/cdca8b3c-f592-4484-867d-5939ad68de17/18564233401.pdf
    • https://uploads.strikinglycdn.com/files/02155b10-5d18-4bba-8dc0-f169df235463/life_span_development_a_topical_approach_feldman.pdf
    • https://uploads.strikinglycdn.com/files/e3ee9f55-8bd6-473a-a5b6-c0811c51f456/2006_gmc_envoy_transmission_problems.pdf
    • https://uploads.strikinglycdn.com/files/00be58d0-c76d-4c78-9b5e-a3ca5af7df67/how_much_does_a_psychologist_make_per_month.pdf
    • https://uploads.strikinglycdn.com/files/55a7d653-8649-4efa-94e2-045ca3a53a40/31410423090.pdf
    • http://wupubobetob.epizy.com/constitutional_law_attack_outline.pdf
    • https://uploads.strikinglycdn.com/files/797acd3a-8f45-4a22-ba76-805f70356b83/delonghi_pinguino_error_code_pf.pdf
    • https://uploads.strikinglycdn.com/files/d1143eb9-a816-4d21-b35b-bb736cc40c13/intercession_prayer_points_2020.pdf
    • https://uploads.strikinglycdn.com/files/a81e394c-c651-420a-81cf-76ada1766079/vogejopovefazezadez.pdf
    • https://uploads.strikinglycdn.com/files/4508cdbb-9c56-4d5a-a38c-7dfa8667492a/how_to_win_a_flush_in_poker.pdf
    • https://uploads.strikinglycdn.com/files/46eec8ac-6a02-40e0-b9db-d20e30dd4b1c/collins_english_grammar_and_composition_class_2_free_download.pdf
    • https://uploads.strikinglycdn.com/files/580fb916-e429-467b-a523-7e27b6843f14/xelavuzope.pdf
    • https://uploads.strikinglycdn.com/files/ce07cade-b6e2-4165-856c-440f0c97919e/15688157628.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de5f.bin
ff2401cc9b68e51e0121cffaa61708535f9c093e75b106200b8c161e424e6ca2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE5F 5280 bytes
font_01_sfnt_off0000f038.bin
0943f04a753c878a075656ad9beb306af53fa607e5bcfa3af6956dceb8f58525		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF038 10180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.