Malicious PDF — malware analysis report

Static analysis result for SHA-256 8033f981fc7b2641…

MALICIOUS

PDF

80.0 KB Created: 2021-04-07 18:31:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ab49e1e226cb306a1d526a78620fd001 SHA-1: 95c92fdc9fcedbef4989edcd427df126986ede66 SHA-256: 8033f981fc7b264125707110ec8e4baae2c49ed3ac206dec74ed6c99e5ef809a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that directs users to a site disguised as educational content, likely a phishing or malware distribution lure. The presence of multiple external URLs further supports the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=lesson+12.3+skills+practice+answers+carnegie+learning
    • http://sutedadudek.22web.org/curso_de_ingles_iniciante.pdf
    • https://cdn.sqhk.co/xubodijixali/dhcjabJ/avid_one_pager_template.pdf
    • http://daimontimur.org/vicks_humidifier_cleaning_manualtynzz.pdf
    • http://kigonowepim.iblogger.org/mutujedaluludelit.pdf
    • http://mon-cmso.best/the_holy_torah_in_english2ftwl.pdf
    • http://dejamorije.scienceontheweb.net/descargar_caballo_de_troya_2_gratis.pdf
    • https://cdn.sqhk.co/nutanujel/eIzgggi/farm_linen_cloth.pdf
    • http://toppiksnack.xyz/errorless_biology_book_free_download9ncau.pdf
    • https://cdn.sqhk.co/ramawuvade/Lgj95yu/sogerokilureson.pdf
    • http://fozakewugumomig.22web.org/cooking_chicken_breast_george_foreman_grill_temperature.pdf
    • http://bigakeka.iblogger.org/duvesi.pdf
    • http://glossywp.online/active_and_passive_voice_worksheets_middle_schooltpk8i.pdf
    • http://znakomstva18x.site/manebog7lwe3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gakilasefit.myartsonline.com/king_james_study_bible_large_print_leather.pdf
    • http://lafotesawopabo.epizy.com/easy_mirror_glaze_recipe_with_gelatin_sheets.pdf
    • http://xazikipigenuvi.rf.gd/garage_workbench_plans.pdf
    • https://uploads.strikinglycdn.com/files/ab7c2081-c9dc-42d7-be70-ac633d4d403e/realtor_final_walk_through_before_closing_checklist.pdf
    • http://mivurekas.epizy.com/asme_section_viii_division_1_2020.pdf
    • https://uploads.strikinglycdn.com/files/05103d30-5783-4e95-9386-c22301b83e56/tamigotapogaxasufila.pdf
    • http://nojozorupugi.epizy.com/bazamisezusozexutonamo.pdf
    • https://uploads.strikinglycdn.com/files/53810921-eddf-4945-bfb3-cf7a1832044d/how_to_describe_a_persons_writing_style.pdf
    • http://tifavamifikas.myartsonline.com/how_to_restart_my_fitbit_charge_hr_2.pdf
    • http://luxorofanogefa.rf.gd/vojozinadawatetonudol.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f805.bin
b3959462542d9f5943326a2a836c1eed80ad2502285a6797fba5c006d1890a77		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF805 5576 bytes
font_01_sfnt_off00010b3d.bin
c33bb12e091366a44121f1e5a7e733162342a05915911a3063b15035bd50e492		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B3D 10672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.