Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e5f594dccb24f4e…

MALICIOUS

PDF

96.8 KB Created: 2021-03-14 13:51:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b490eaccd20a2618e87ea0adf1e8a090 SHA-1: 1f87eb5f150ac8eb0cda4bb03bb3dc066f3b1253 SHA-256: 7e5f594dccb24f4efd17719f35a731da47804d112d9ad9b6013997fcd5a06f7a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that appears to be a lure for downloading IELTS vocabulary materials, which is a common tactic for phishing and malware distribution. No scripts were extracted, but the presence of external URLs and the nature of the detection suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=ielts+vocabulary+pdf+free+download
    • https://cdn-cms.f-static.net/uploads/4407057/normal_5fd8169d6e811.pdf
    • https://cdn-cms.f-static.net/uploads/4366344/normal_60220b6833f20.pdf
    • http://shtangennstutkupitseychas.xyz/828612953805mui5.pdf
    • http://dimozakebaba.scienceontheweb.net/96481412721.pdf
    • http://leomannapov.com/27341731407rxupm.pdf
    • http://sebevifa.getenjoyment.net/42286424625.pdf
    • https://cdn-cms.f-static.net/uploads/4426261/normal_604bc845d8745.pdf
    • https://static.s123-cdn-static.com/uploads/4489402/normal_60090764d8151.pdf
    • http://kamaz-ftc.com/xefusugufof2k58j.pdf
    • https://cdn-cms.f-static.net/uploads/4443619/normal_603901f3d9cc6.pdf
    • http://nunejabu.scienceontheweb.net/22689256124.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://8d90b851-447f-4cfc-ac95-1e867b71b983.filesusr.com/ugd/b371d9_da680dba20234bbdb3e133b19eeaffea.pdf?index=true
    • http://gupizamowakop.myartsonline.com/phonetics_meaning_in_tamil.pdf
    • https://s3.amazonaws.com/vuterijoze/ironing_of_silk_sarees_answers.pdf
    • http://xuxidiso.epizy.com/why_is_my_voicemail_not_working_iphone_11.pdf
    • http://boparozib.rf.gd/cvs_warm_steam_vaporizer_spitting_water.pdf
    • https://s3.amazonaws.com/faxaxos/nuvivoweken.pdf
    • https://b7e73dfe-ad35-4791-b4f7-7500f5b7882c.filesusr.com/ugd/bc79a4_183f8d665ed4498297dab53e77145aaa.pdf?index=true
    • https://s3.amazonaws.com/daxemo/2019_afrobeat_mix_afro-_mania_5_free.pdf
    • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_d4743fe3d4794634b5982e873eadb41e.pdf?index=true
    • http://nukilaba.myartsonline.com/pefofej.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001112b.bin
14b0768fb8fb32f32fce7db9b81eb44019f9e1f136311780469f51070f12b842		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1112B 5316 bytes
font_01_sfnt_off00012356.bin
316f78c6e162999e43ccb83d429ef85c46045bf1ac59c77d169faf589ecd4eba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12356 2116 bytes
font_02_sfnt_off00012d00.bin
33ce0c6d156d95ffbeebd0be06768528bf41fda274919a5c17ffb1625217adc8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D00 10864 bytes
font_03_sfnt_off0001520e.bin
e7273338525a866f49bd556f13a0e46ce1e8513f85f175d9d987aa1f8b89adb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1520E 16068 bytes
font_04_sfnt_off000166b2.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166B2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.