Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ca69bedfa03d8d4…

MALICIOUS

PDF

80.4 KB Created: 2021-04-21 09:03:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 782866fb415959e9526fefcffd1e81a7 SHA-1: 5f642539ebeb02f76f1f970c2367dec2e450df0a SHA-256: 6ca69bedfa03d8d4f87e065bfb25e811a30ef86ce739a67c71a6e034e79cb9c8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that redirects to a suspicious domain, likely serving as a lure for users seeking academic material. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=introductory+mathematical+analysis+pdf+download
    • https://cdn-cms.f-static.net/uploads/4444853/normal_60118bb146677.pdf
    • https://cdn-cms.f-static.net/uploads/4414498/normal_602d6ead3613e.pdf
    • https://cdn.sqhk.co/ledivure/ieyVbgg/lagos_mass_choir_songs.pdf
    • https://cdn-cms.f-static.net/uploads/4465263/normal_606ea13092c6b.pdf
    • http://uablog.website/how_to_start_porter_cable_air_compressori51zx.pdf
    • https://static.s123-cdn-static.com/uploads/4417983/normal_60030a84a7dc2.pdf
    • http://moneymaya.site/what_is_boundary_condition_in_psychologypds73.pdf
    • https://cdn-cms.f-static.net/uploads/4476757/normal_605b224d7f405.pdf
    • https://cdn.sqhk.co/tezofugowura/fmz9won/25690446003.pdf
    • https://cdn-cms.f-static.net/uploads/4480884/normal_602cac125a74a.pdf
    • http://mnogolidov.xyz/chalte_chalte_song_instrumental_ringtonewfosv.pdf
    • https://cdn.sqhk.co/fudamewojaf/jdifhfi/70339818220.pdf
    • https://cdn.sqhk.co/tajixixejafi/cdl8n4i/trendler_gundemi_takip_edin_in_english.pdf
    • https://cdn-cms.f-static.net/uploads/4446038/normal_605c09cb6f5fc.pdf
    • https://cdn.sqhk.co/loxosefivipo/8Xjj18k/bounce_back_definition_synonym.pdf
    • https://cdn-cms.f-static.net/uploads/4374522/normal_601041e83eb06.pdf
    • https://cdn-cms.f-static.net/uploads/4412606/normal_60472f865545d.pdf
    • https://cdn-cms.f-static.net/uploads/4420025/normal_60418eba01340.pdf
    • https://cdn-cms.f-static.net/uploads/4481684/normal_602245089b6ea.pdf
    • https://cdn-cms.f-static.net/uploads/4412767/normal_5fd179e9749e4.pdf
    • https://cdn-cms.f-static.net/uploads/4500667/normal_604cd4c24ed40.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fusidejebi/girl_guide_cookies_canada_types.pdf
    • https://s3.amazonaws.com/numunenoji/discrete_mathematical_structures_with_applications_to_computer_science_download.pdf
    • https://s3.amazonaws.com/lusabifef/golden_frame_png_free.pdf
    • https://s3.amazonaws.com/jotizifime/delayed_flight_compensation_template_letter.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e23e.bin
e36519d6ee91beb20618084a18baccb550195de6565c08514909c25385ae1713		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE23E 5528 bytes
font_01_sfnt_off0000f4f3.bin
e4e4c2801b0baf464ce9e25fa1b43e2762aa5df7eec9d55cdaeae2ae3e10b744		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4F3 11548 bytes
font_02_sfnt_off00011b5a.bin
bcd3a4256ca1f77ed780763cd04954e3d4dc2711b9fc4f7b5043fffa08419975		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B5A 16552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.