Malicious PDF — malware analysis report

Static analysis result for SHA-256 7efc8b345f91ba3b…

MALICIOUS

PDF

81.4 KB Created: 2021-03-29 11:07:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f87ef1448546cd66b67f25bcc27a42d SHA-1: 925cd0ffb6818bf4641ed274596b78a39e6340e8 SHA-256: 7efc8b345f91ba3ba4d262959bbceb2625efb9fd28d1f3a88b1471a7d7e9c033
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, suggests it is presented as a worksheet, a common lure for phishing or malware delivery. No scripts were extracted, but the presence of external URIs indicates a likely attempt to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=winter+sports+merit+badge+worksheet
    • https://cdn.sqhk.co/jadosoxiko/jgcDie2/36424860457.pdf
    • https://cdn-cms.f-static.net/uploads/4414334/normal_605019578bc4a.pdf
    • http://thepropheticapp.com/66374594061oriyx.pdf
    • https://static.s123-cdn-static.com/uploads/4443292/normal_5ff3fbdd1f603.pdf
    • http://mosquito.codes/1075661390299i7k.pdf
    • http://septiki-rf.website/tbc_blacksmithing_guide_warmanekrctd.pdf
    • http://wordwild-store.com/off_season_basketball_weight_training_programhpxvj.pdf
    • https://cdn.sqhk.co/videgogaf/ChfXgjc/bingo_cancion_infantil_en_ingles_con_letra.pdf
    • http://pitikudefojeken.getenjoyment.net/psycho_book_bates_motel.pdf
    • http://woxijakuzadajew.getenjoyment.net/felazuxasomugegefimekek.pdf
    • http://valigulepi.scienceontheweb.net/69298349404.pdf
    • https://static.s123-cdn-static.com/uploads/4487632/normal_5ff042a4c0f02.pdf
    • https://cdn.sqhk.co/tevunufoba/jCjcibT/best_tuner_for_6._7_cummins_without_delete.pdf
    • https://cdn-cms.f-static.net/uploads/4381104/normal_5fd8616b9c123.pdf
    • http://naturalik.fun/turbo_aow_engine_freees0yy.pdf
    • https://cdn-cms.f-static.net/uploads/4372702/normal_5fd290a029cd2.pdf
    • https://cdn.sqhk.co/bikakigiben/Fia2Mjd/zorabelerugodifo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://f8d4b294-f952-4a11-85e8-0a3036f9bdaf.filesusr.com/ugd/ad8f3a_152f978826f64de4b88e7f42bea9ddce.pdf?index=true
    • http://jozilaro.atwebpages.com/dalanokizadegazevufuseb.pdf
    • https://413f70bc-0247-4a04-a3fc-eabb14e2b93f.filesusr.com/ugd/f18ee6_7110be220b9d4ce69c9f96aa46638759.pdf?index=true
    • https://5be7aec3-7d66-433b-ae1d-2bfb807ddf2a.filesusr.com/ugd/24deb6_f0a40518a2b84f2ba8956f5c3a471529.pdf?index=true
    • https://18e99e0c-7034-4a8c-9069-267580a295b8.filesusr.com/ugd/b337f5_aa888754b4d84ecebf065041173e7df4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef2c.bin
33b6270590e48471b4b093b91c77b513fb5cb027428f5c218c0f2af07b6e3d56		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF2C 5436 bytes
font_01_sfnt_off00010186.bin
b487203728bff9e1033ad1165911d6fed1ebc2459570aa10dad6db467a358557		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10186 12024 bytes
font_02_sfnt_off0001288e.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1288E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.