Malicious PDF — malware analysis report

Static analysis result for SHA-256 6eb63560584a3e34…

MALICIOUS

PDF

85.8 KB Created: 2021-02-24 13:40:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: 28bc94a8d76ec06b0bcee6860bfee3f8 SHA-1: 6bfec60019597747b004c2a36809e9c2fd4c65d9 SHA-256: 6eb63560584a3e34085f805fb142cff9220d8499064d4576898bceb77cdec369
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that redirects to a suspicious domain, masquerading as an academic test. ClamAV and ML classifiers strongly indicate maliciousness. The presence of external URIs and the overall structure suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=algebra+1+benchmark+test+3+answers PDF link annotation
    • http://acupofjacob.com/3043776849526hc9.pdfIn PDF document text
    • http://businessoutsourcing.org/el_antiedipo_capitalismo_y_esquizofrenia4enbx.pdfIn PDF document text
    • http://betflixguvenilirmi.com/power_of_now_book_clubg2iv2.pdfIn PDF document text
    • http://wowitaly.space/dasivijisojowosqvuif.pdfIn PDF document text
    • http://bbflowers.net/dyson_cinetic_big_ball_animal_upright_vacuum_manualxey5s.pdfIn PDF document text
    • http://apparentlyopt.com/send_in_the_clowns_free_sheet_musicclekm.pdfIn PDF document text
    • https://cdn.sqhk.co/vefapatape/fhiigii/mularifofisetiwelerozafo.pdfIn PDF document text
    • http://linza.media/99363053239uw9rf.pdfIn PDF document text
    • http://gobigs.space/16661488675fbvlh.pdfIn PDF document text
    • http://bilet-pdd.site/16803882572vtaet.pdfIn PDF document text
    • http://arevakar-travel.com/parenting_tips_for_toddlers_with_adhd2mvq4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/xewamejixolefaj/samsung_alarm_clock_ringtone.pdfIn PDF document text
    • https://s3.amazonaws.com/jazamerijekufol/zujogovufiratuwejimurebi.pdfIn PDF document text
    • https://s3.amazonaws.com/rimepusox/diagramas_de_bobinados_de_motores_electricos.pdfIn PDF document text
    • https://s3.amazonaws.com/petuzutemixuvod/android_x86_system_requirements.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/75203088367.pdfIn PDF document text
    • https://s3.amazonaws.com/fuvidokibet/69005689632.pdfIn PDF document text
    • https://s3.amazonaws.com/jolunenafobuw/janapada_geethegalu_song.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001056c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1056C 5344 bytes
SHA-256: f53818d1abd745b2da37542dbde220581490c800026a99f49ace62f20d42f8bf
font_01_sfnt_off00011770.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11770 10528 bytes
SHA-256: 682060cff2f64d3ec3ee8af96f41c6bd1d47ca84d55c6c2a4326cf5af28400b3
font_02_sfnt_off00013b49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B49 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.