Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d37d1d2c8991dbd…

MALICIOUS

PDF

74.6 KB Created: 2021-06-01 13:31:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b869b8de1d8ffbaefc489f533f159b48 SHA-1: d2b73f316c22e99753c790f05f39a4816c698939 SHA-256: 6d37d1d2c8991dbd9117c6f58f53cdeff2f39bc54776236ee5a54689dc0d54f1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing lure. The document body, though heavily obfuscated, suggests a template for a college leaving certificate, indicating a social engineering pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=college+leaving+certificate+template
    • https://sojikopel.weebly.com/uploads/1/3/4/7/134760404/fumujoge.pdf
    • https://nojokubovurob.weebly.com/uploads/1/3/1/6/131606526/migor.pdf
    • https://fabisinutufonos.weebly.com/uploads/1/3/5/9/135993578/7232785.pdf
    • https://static.s123-cdn-static.com/uploads/4474746/normal_5fcd584c74acf.pdf
    • https://durapafived.weebly.com/uploads/1/3/1/4/131438767/1855166.pdf
    • https://cdn-cms.f-static.net/uploads/4427274/normal_60417fdf436fe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/713a57d9-afdf-45e9-aedb-f42759d94d85/how_to_reprogram_a_comcast_remote.pdf
    • http://midevodimu.pbworks.com/w/file/fetch/144448506/kedamudimuvavimegadeka.pdf
    • http://xuruzinijub.pbworks.com/w/file/fetch/144423399/15552984218.pdf
    • http://bupataved.pbworks.com/f/1776_musical_libretto.pdf
    • http://zufumegi.pbworks.com/f/what_are_the_duties_and_responsibilities_of_a_finance_officer.pdf
    • https://uploads.strikinglycdn.com/files/1099c006-5516-4565-b387-d5741abb508f/behringer_xenyx_1202fx_compression.pdf
    • http://nadupodifado.pbworks.com/w/file/fetch/144448038/sovesododu.pdf
    • https://uploads.strikinglycdn.com/files/348efecb-e8cd-426e-8981-490f706b1277/mutedujopuwifuzejo.pdf
    • http://kufujibumufa.pbworks.com/w/file/fetch/144411678/survivor_39_episode_1_watch_online.pdf
    • https://uploads.strikinglycdn.com/files/e7d5e9fa-f510-42e8-af6c-1e13075528a6/zesefipafasivuzadikaj.pdf
    • https://uploads.strikinglycdn.com/files/dbb2791f-d041-4483-9d1b-cfce3d84edac/48151048082.pdf
    • http://sazupamufode.pbworks.com/f/penny_stocks_to_watch_today_india.pdf
    • http://jijagenaneke.pbworks.com/w/file/fetch/144438639/jofax.pdf
    • http://mifimoruzuwo.pbworks.com/f/xajoziposonatofim.pdf
    • http://funinupun.pbworks.com/f/31231315294.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7ae.bin
9b2ee72daf95735c20094c1009937427aa87a3e31f8123d93a0b04a5ecbeb787		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7AE 5124 bytes
font_01_sfnt_off0000f915.bin
73143e507cb934eb3667eb33bdbe3a81e66ca8eed1ade7419767401ea6c42de2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF915 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.