Malicious PDF — malware analysis report

Static analysis result for SHA-256 7125b657aed4c58f…

MALICIOUS

PDF

84.7 KB Created: 2021-03-10 09:42:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8422abc572542323a3474078b049a55a SHA-1: 70f3685a7428eb415d815bbd6d0c05dc08f46b9b SHA-256: 7125b657aed4c58f1cf4e1378a6279eda5d60e7f23404b7d5407218584a153ef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to an 'algebra 2 diagnostic test'. No scripts were extracted, but the PDF structure itself facilitated the embedding of the malicious URI.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=algebra+2+diagnostic+test+pdf
    • http://soldonlakewood.com/balerato_masione_songplx7f.pdf
    • http://classicalnaturally.com/10113316435td1ip.pdf
    • http://yeswins.space/book_of_romans_bible_study_questions_and_answers8329a.pdf
    • http://perevod24-card2card.site/guess_the_creepypasta_free_for_all_20180imik.pdf
    • http://esclub.pro/galore_park_english_year_5_answersxbyb9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/5d5654ba-348c-4cac-a292-fdb53d517f84/minn_kota_powerdrive_bt_45_spot_lock_micro.pdf
    • https://uploads.strikinglycdn.com/files/8c13e86d-51eb-4b61-822f-d0111fe41f45/223956724.pdf
    • https://uploads.strikinglycdn.com/files/6501808d-0d05-4b3c-b50d-9bfb1ba32824/32068878553.pdf
    • https://s3.amazonaws.com/gotitibekovi/jesagafupudusa.pdf
    • https://uploads.strikinglycdn.com/files/549b3da0-fd61-4e56-815e-bf5e0597aaa8/jinobadukugexujubafaf.pdf
    • https://uploads.strikinglycdn.com/files/570cc2ff-cbde-4763-a999-d2d80a4d6ba2/how_high_are_hurdles_for_12_year_olds.pdf
    • https://uploads.strikinglycdn.com/files/d38365c6-4dc7-422a-a8fd-a0e6085490ae/dlink_dcs-5222l_setup.pdf
    • http://nasapatede.epizy.com/fuwogimapep.pdf
    • https://s3.amazonaws.com/jinotugiwomo/luzodojuwiwap.pdf
    • https://uploads.strikinglycdn.com/files/164fbd55-c2a4-41dc-9fd3-4cf3738590dd/45639976517.pdf
    • https://s3.amazonaws.com/tufitijinexu/schwinn_airdyne_user_manual.pdf
    • http://fogevodazeta.epizy.com/vepuku.pdf
    • https://uploads.strikinglycdn.com/files/208822f4-3461-4278-94cd-dad056656d06/bavopibofixivalunul.pdf
    • https://uploads.strikinglycdn.com/files/4729f6c9-8f49-4e78-ae9b-02dfc9912482/gunedotovekitaxum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb5f.bin
db168827ea6542d9f2491d2449f993f6c42ca0bda401449b3c6d4710a79247cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB5F 5372 bytes
font_01_sfnt_off00010da7.bin
cdf48701c7de453dda9bc83c25720dcaf21df62cfca8c4794cb1b6a01741c761		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DA7 13116 bytes
font_02_sfnt_off00013763.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13763 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.