Malicious PDF — malware analysis report

Static analysis result for SHA-256 7683b41db4deea80…

MALICIOUS

PDF

78.4 KB Created: 2021-07-13 19:21:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8d261a40adbf9ee9f5d78ed52ea2c983 SHA-1: 19b8fa03fa9bc3b41fafcb3a4bc3d81599b91c14 SHA-256: 7683b41db4deea80d64442e64e61b08d7a22a368ab39efaabe209dacf9c8b1d5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating phishing and trojan characteristics. An external URI pointing to 'infrive.ru' was extracted, which is highly suspicious. Although no scripts were directly extracted, the PDF structure and the presence of external URLs suggest an attempt to redirect users to a malicious site, likely for phishing or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8678

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/square?utm_term=paper+towns+release+date
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e84e510513ea69873a8a80/1625837137543/fat_loss_workout_for_females.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e9367cf4fe78435a3b7f80/1625896572685/depinagutejukago.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edb28958c2e00095633cc3/1626190473771/cricket_interview_questions_and_answers.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e7714eba01500bc0186801/1625780558912/vepofuwunasibe.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8f4662dabf272355242c2/1625879654380/vasuxir.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e7854d2a59c44508a957c5/1625785677969/ben_stiller_theres_something_about_mary.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60edb5c9834e745de9d30095/1626191306064/43749498501.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d106.bin
e23993149e9b745d0bfc44f2fd5a0fce1e41059eb63c01323a5c1b1d87edf045		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD106 10380 bytes
font_01_sfnt_off0000e8b9.bin
3cf04ea4108c6aaa42e7a9f1a66da62c0b0223e5a87262c846e267686c79b5cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8B9 17584 bytes
font_02_sfnt_off000115c0.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115C0 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.