Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c39daa16c6f5200…

MALICIOUS

PDF

72.2 KB Created: 2021-03-20 18:28:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 96cd351b4187fe7ae43f8429225cdf87 SHA-1: d1459d3306285cf53e20e21ddd20271f866412b6 SHA-256: 6c39daa16c6f52000c54d7032056ad17f55cc76f57db83f1995020b823f8376b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that points to a suspicious domain, likely intended to phish or deliver a payload. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to educational content, aligning with a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=everyday+math+6th+grade+study+links+answers
    • http://duxinivodozular.mywebcommunity.org/pioneer_sx_950_receiver_amplifier.pdf
    • https://cdn.sqhk.co/rijolumexeb/1ifaid2/add_app_drawer_icon_nova_launcher.pdf
    • https://cdn.sqhk.co/noremixujor/ibrhjw6/how_does_anti_aircraft_flak_work.pdf
    • http://fakixigulidol.mywebcommunity.org/72542372641.pdf
    • https://cdn.sqhk.co/gupidiroka/eUgeieL/87692558598.pdf
    • http://vexetifiridik.mypressonline.com/how_to_analyse_a_graph_in_english.pdf
    • http://fesatele.22web.org/67331078137.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sokipev.epizy.com/folic_acid_in_pregnancy.pdf
    • https://s3.amazonaws.com/wajufifenoxuj/certified_ethical_hacker_book_v10.pdf
    • https://c18d7360-3707-4bf1-9d6f-52ba7510fa17.filesusr.com/ugd/76cb06_a9a88a86fe3f4f5fa534874854a62235.pdf?index=true
    • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_a3bd7342d8234bff899ac59f2a68b124.pdf?index=true
    • https://uploads.strikinglycdn.com/files/53b50c02-1e6f-4689-b739-acb5878ece61/penomipewupekixifasap.pdf
    • https://uploads.strikinglycdn.com/files/49eb2b63-bbfc-49d1-99ff-e3da4163b68f/bazuzujabekovibexivaka.pdf
    • https://s3.amazonaws.com/lukepepe/toshiba_satellite_touchpad_driver_windows_7_download.pdf
    • https://6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com/ugd/12745a_0f370d1bf8744bbda34fc707779144fb.pdf?index=true
    • https://s3.amazonaws.com/rixevozajixezos/93947386775.pdf
    • https://s3.amazonaws.com/piradi/directv_now_guide_page_down.pdf
    • https://uploads.strikinglycdn.com/files/7acd2c3c-40c9-4100-ab29-70f715860e87/minn_kota_865_autopilot_manual.pdf
    • http://mugomodag.atwebpages.com/terikunonexe.pdf
    • https://s3.amazonaws.com/toguvaju/is_a_tesla_worth_it_2020.pdf
    • https://7ef7ebf0-bcb0-4ca2-8538-5a19c3e9f01c.filesusr.com/ugd/aff7ca_cf0f93addae447ff852582deaa038c27.pdf?index=true
    • http://zovaner.rf.gd/how_to_make_brown_rice_in_hamilton_beach_rice_cooker.pdf
    • https://571cbd0a-ba82-408d-be6d-2df53a8fcfe5.filesusr.com/ugd/02af14_2b0e69fa7a3a4ac8be3544e8af50f14a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcf5.bin
6e7b314ee88100dfca815294ed81c11a5d506e2ae099f118bf088cd3b1c398cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDCF5 5668 bytes
font_01_sfnt_off0000f035.bin
6f20833cd718d6708add95a755006c1279d22e2ac3d1d461095bd579f8b6e4e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF035 10084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.