Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d17e06ac0f62fe3…

MALICIOUS

PDF

73.5 KB Created: 2021-03-28 13:19:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07d02757bd38d7a970d4fccf5d664b25 SHA-1: d1edc7930ff2acc209a4538d766daa804aacf702 SHA-256: 6d17e06ac0f62fe37c11b5359b1699a2c47be4f8ebcf22b6c58adb5cb0c2fc7d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search result for a book, a common lure for phishing or malware delivery. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=basics+of+computer+science+book+pdf
    • http://winoraama.fun/weather_vocabulary_ieltsq25t6.pdf
    • https://static.s123-cdn-static.com/uploads/4447467/normal_60025feaa88f7.pdf
    • https://cdn.sqhk.co/zegofurop/sAbicij/sql_server_express_2008_r2_x86.pdf
    • https://cdn-cms.f-static.net/uploads/4370740/normal_60460d1ea30a7.pdf
    • https://static.s123-cdn-static.com/uploads/4470027/normal_5fdf28b79bc05.pdf
    • http://barcaporirternet-interbank-pe.com/sntomas_de_autismo_en_nios_de_2_a_3_aos9cp17.pdf
    • http://tvoeobrazovanie.fun/vixezulugukowuwedatolujiy8ulo.pdf
    • https://cdn.sqhk.co/mopomotop/ZuHidIm/zeloladus.pdf
    • https://cdn.sqhk.co/lakagifoter/gT9Whju/the_maze_a_labyrinthine_compendium.pdf
    • http://life-news.tech/never_fade_away_lyrics_pt_adamczykcyct5.pdf
    • https://cdn.sqhk.co/gipekoma/jiaghic/nabalireziwirejur.pdf
    • https://cdn.sqhk.co/pabelewexo/ibge8ia/war_strategy_games_ps4_2019.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tumasun/video_editor_apk_best.pdf
    • https://1618b3f4-dcc0-4047-a816-eeb1cbe43c51.filesusr.com/ugd/a01749_669d5eab1e75434bad2b7a1bf5cf9df8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5f769555-4485-490a-9f1c-4ce5e2bcd383/is_negative_negative_a_positive.pdf
    • https://2e03c77f-99cc-4591-9807-54d8d49c9ce6.filesusr.com/ugd/759733_c462499307c7433bb56a97e109f220a0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/410b10b9-c558-443b-9f64-27dc0fafb3f9/boss_br-800_digital_recorder_software.pdf
    • https://s3.amazonaws.com/bejokazemur/71606812431.pdf
    • https://s3.amazonaws.com/tudawufed/catalogo_mary_kay_2018.pdf
    • https://s3.amazonaws.com/mejigavukolu/draven_adc_guide.pdf
    • https://0bef8565-087b-457a-960c-b0529baba50c.filesusr.com/ugd/638000_7f1f02417ca54beb89d5ae5a608769dc.pdf?index=true
    • https://f06ae689-34e6-4fd9-b749-a5985747e370.filesusr.com/ugd/4117a9_9a22bbea9f344c4291c7b45ed528f1d6.pdf?index=true
    • https://21a67f6d-2aea-439f-a910-ed4feb6be009.filesusr.com/ugd/173616_b23bc56809224b77a5c9c84b0396f267.pdf?index=true
    • https://s3.amazonaws.com/wetowuzuxit/a_study_in_scarlet_quotes.pdf
    • https://uploads.strikinglycdn.com/files/1ffde658-556c-4a7c-a223-18049e967e20/28254064407.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd5e.bin
177ab5f43269488b47bd8265c880eb7c620b047ed149344616cfaa9aedf97701		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD5E 5524 bytes
font_01_sfnt_off0000f00c.bin
50da504bd5a942848cbc66fbb1f510a008efcae22a4520092c1dd8fafb1f82e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF00C 11716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.