Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b4d3124d45c17d9…

MALICIOUS

PDF

78.4 KB Created: 2021-03-31 05:39:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 96cef0e365c5402482046fcba1464321 SHA-1: 1e277ca8a39c6fb0524647045dc742a52429e9b6 SHA-256: 6b4d3124d45c17d9650193ad757c5dc8e70b4ec7bdeaeb0f4e57d5a6c0c02606
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious URL, disguised as a geography answer key. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to trick the user into navigating to a malicious site, likely for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=daily+geography+grade+5+answer+key+week+19
    • https://static.s123-cdn-static.com/uploads/4366630/normal_5fdcbe0ddf702.pdf
    • https://cdn.sqhk.co/gabixeme/chjjdjf/podakaja.pdf
    • https://cdn.sqhk.co/gedugari/jNesbha/diarrhoea_vomiting_covid_19.pdf
    • https://cdn.sqhk.co/dunuxorigu/eXMaqhb/adobe_premiere_title_effects_free.pdf
    • http://baliferifopiz.mypressonline.com/11955242935.pdf
    • http://viwafuxofiseko.getenjoyment.net/nixewuriw.pdf
    • https://cdn.sqhk.co/rokajoten/Phfjfgi/barcode_scanner_maker.pdf
    • https://static.s123-cdn-static.com/uploads/4419192/normal_5fcc4e31a33c7.pdf
    • http://najetaxu.mygamesonline.org/mapopevo.pdf
    • http://sewatumafuta.medianewsonline.com/gelexibulogugutoxonejejof.pdf
    • https://cdn-cms.f-static.net/uploads/4477626/normal_5fd2faee4de6f.pdf
    • http://palubofapejuraw.mywebcommunity.org/86471721916.pdf
    • https://cdn-cms.f-static.net/uploads/4421474/normal_5fd2e7c706d4f.pdf
    • http://gonifarej.mywebcommunity.org/1382630342.pdf
    • https://static.s123-cdn-static.com/uploads/4477400/normal_5fcb00efb6fe7.pdf
    • http://rijoginijamibeg.mypressonline.com/buddhist_social_philosophy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://451b78f8-089e-4d4d-bc4b-60abb621f7e6.filesusr.com/ugd/7ef0dc_40210af697814805b825736b586bfb1c.pdf?index=true
    • https://f0f855fd-29d2-4bf6-9fdd-af1de8d1f91d.filesusr.com/ugd/184831_0bc56af816294598bf0826cd93e3d89d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/69125deb-da50-4fa4-870c-b1197cd0988f/54685001638.pdf
    • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_3a0213d4d13d4a52b55efff3626fb61d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d1a92498-34e6-4052-837e-eec09dde5645/garmin_gtx_327_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/aae92fe1-016d-42bd-ae19-33c39eb58c96/mugujevelewagovesowux.pdf
    • https://uploads.strikinglycdn.com/files/1ff1f7b4-296b-40cb-b66a-af89883a73d5/52724613344.pdf
    • https://7ed754b6-a209-4558-9281-0032c7ee8ade.filesusr.com/ugd/4329d7_178bdf10b90647dd91b8122ab7b9a01a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2eb.bin
7ed13f7677c5b0c3a79d23eff369390af0d4cf7720aa2c2dac0a23c8c7e27272		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2EB 5812 bytes
font_01_sfnt_off000106d6.bin
e07333adebd2fb234325984cf7122374f6bc444a25b28a967e3c8917807c4026		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106D6 10936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.