Malicious PDF — malware analysis report

Static analysis result for SHA-256 77cd29728af34e29…

MALICIOUS

PDF

75.1 KB Created: 2021-03-10 05:01:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 593a95dca726872727bc3750b6da1aaa SHA-1: 5123d139b9f39a824fedab1e0aa36b9f6acb46da SHA-256: 77cd29728af34e29d0a138e18cbeb67dd019a3472c577c11d743713ca15bcf54
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to educational content ('Finding volume of 3d shapes worksheet'). The presence of embedded URLs and the overall detection by security tools indicate a phishing or malware distribution attempt, likely leveraging a PDF exploit to redirect the user to the malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=finding+volume+of+3d+shapes+worksheet
    • https://cdn.sqhk.co/sawijewabob/j03nVid/83970705683.pdf
    • https://cdn-cms.f-static.net/uploads/4387939/normal_60248314e68b2.pdf
    • https://cdn.sqhk.co/mezutorixo/n4nBjix/word_cookies_game_app.pdf
    • https://static.s123-cdn-static.com/uploads/4381340/normal_6009292c4c489.pdf
    • https://cdn-cms.f-static.net/uploads/4497646/normal_601f02feeccdd.pdf
    • https://cdn.sqhk.co/genopeno/Chagddf/rigal.pdf
    • https://cdn-cms.f-static.net/uploads/4449604/normal_600adaafb9c14.pdf
    • https://cdn.sqhk.co/zejejofe/kkhaidg/mogatamukolojexev.pdf
    • https://cdn-cms.f-static.net/uploads/4443372/normal_601da5bde6e40.pdf
    • https://cdn.sqhk.co/vomifavafo/4PSMILG/42293080419.pdf
    • https://cdn.sqhk.co/nejisakatok/jCQjcjd/fatal_fury_special_pc_engine_rom.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sutawowirosuvuv/pevobu.pdf
    • https://s3.amazonaws.com/lizuseguwix/butterball_masterbuilt_xl_digital_electric_indoor_22_pound_turkey_fryer.pdf
    • https://s3.amazonaws.com/boduxatavepe/pagefulawerubofawo.pdf
    • https://uploads.strikinglycdn.com/files/76adfffb-ee6a-4bcb-9fd1-7a52192e46b3/62173371506.pdf
    • https://uploads.strikinglycdn.com/files/e6f32d25-cba6-43f6-9105-ddefacdace6a/norcold_n611_recall.pdf
    • https://uploads.strikinglycdn.com/files/b1f69368-9e65-417d-aa6b-e352e1052b20/99093158841.pdf
    • https://s3.amazonaws.com/duzexefemosaxe/que_es_la_composicion_artistica_en_el_dibujo.pdf
    • https://s3.amazonaws.com/xubifupi/lightroom_presets_free_zip.pdf
    • https://s3.amazonaws.com/kovibu/whirlpool_cabrio_gas_dryer_repair_manual.pdf
    • https://s3.amazonaws.com/jejulurowev/jadubizumuzavi.pdf
    • https://s3.amazonaws.com/fulazelof/capacitor_start_induction_motor.pdf
    • https://s3.amazonaws.com/xaliwalufoguni/repalubavaxalebuxufafu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5d7.bin
5189d0eb6c1e74f8eca11a373bc3721755a02204351144c0c74bc2a743061f76		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5D7 5792 bytes
font_01_sfnt_off0000f97a.bin
9708b92883dfb719e4a576e328ecd3a262b001904250604d148744df040a9979		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF97A 10828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.