Malicious PDF — malware analysis report

Static analysis result for SHA-256 68a0edba7c87c246…

MALICIOUS

PDF

96.1 KB Created: 2021-02-18 00:25:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 532c97a153bcdd3f4b322e3c0ea2bf78 SHA-1: 727907935e119f34ad1ad577cb53421c5bc86436 SHA-256: 68a0edba7c87c246cb6fdeeb12ad18d4a79154992cf4107e46752a5bf51f64ec
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a website disguised as an educational resource. This URL is likely used to deliver a malicious payload or phish for credentials. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=electron+configuration+worksheet+1+answers
    • https://cdn.sqhk.co/jemitaso/mjcLnid/54547009170.pdf
    • https://jerexibim.weebly.com/uploads/1/3/4/6/134654770/a0831c2.pdf
    • https://cdn.sqhk.co/povewepalu/PcTgf5x/archery_equipment_for_sale_near_me.pdf
    • https://sepafolelobonel.weebly.com/uploads/1/3/4/6/134614676/tuvogirojulinega.pdf
    • https://cdn.sqhk.co/raxoxawupej/dMijhi1/packers_bears_score_2020.pdf
    • http://mivetys.xyz/98385253309oyo6g.pdf
    • https://novigavaze.weebly.com/uploads/1/3/0/8/130874354/2581960.pdf
    • https://takigufumugo.weebly.com/uploads/1/3/5/3/135345847/26778c1.pdf
    • https://cdn.sqhk.co/lupobikud/hqQhdjc/48914460967.pdf
    • https://kibasixeb.weebly.com/uploads/1/3/1/4/131438563/watosovavevazid-gatavobevaja-ruvikom-favogebuf.pdf
    • https://nidiladidubupa.weebly.com/uploads/1/3/4/7/134753920/vivofijud-semomenuvapekol-nisobavoratapo.pdf
    • http://reduslimitalia-oficial.site/beetalk_ios_2._3._6lih64.pdf
    • http://sajitalunaded.22web.org/zonabasol.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/rutufokedizon/pirojokenin.pdf
    • http://sixijoras.epizy.com/kshatriya_song_ming.pdf
    • http://vedegisawopuf.epizy.com/turn_off_yahoo_news_notifications_chrome_android.pdf
    • https://s3.amazonaws.com/wexoteluwag/cardiopatias_congnitas_acianticas.pdf
    • https://s3.amazonaws.com/fedojigudaj/63008870231.pdf
    • https://s3.amazonaws.com/fosagoba/vojagajulekupanamigoj.pdf
    • http://tugojolowok.epizy.com/45625500853.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000117f0.bin
cb9072f881c1fe0ad8900bbcc5a20a23fabb306412f64e001cac76c2a9509f2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117F0 2952 bytes
font_01_sfnt_off0001227f.bin
ddae02f24d47ce6af9c112a4d22c0beb4bd05281d2cf7ee7a489a363da8b3e21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1227F 5308 bytes
font_02_sfnt_off000134ab.bin
333a2b484f7d8fca5e19e8f875297f79543fa3b276468ca85fcf65daf49e179c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134AB 10980 bytes
font_03_sfnt_off00015a58.bin
283cbd2003bbaf00e06092c505c6628f30d1026dd006debf474144b1bb97e3f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15A58 16320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.