Malicious PDF — malware analysis report

Static analysis result for SHA-256 808a68306ac3087e…

MALICIOUS

PDF

79.8 KB Created: 2021-03-21 03:53:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 33b69b8b2be1808af015b240356b3167 SHA-1: 178aeb675981ee371fd444845a4f260c6fe062e8 SHA-256: 808a68306ac3087ef89d189fa415328bc67fce0a756a1104987d4829593cf401
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a secondary payload or redirect the user to a phishing site. The document body, though heavily obfuscated, references "lesson 10 exit ticket answers", suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=lesson+10+exit+ticket+answers
    • https://cdn.sqhk.co/woxekivepi/OgehazU/strategic_marketing_plan_powerpoint_template.pdf
    • https://cdn-cms.f-static.net/uploads/4413967/normal_60327607c0deb.pdf
    • http://lugabev.mygamesonline.org/cessna_150_flight_manual.pdf
    • https://cdn-cms.f-static.net/uploads/4500446/normal_6015c8ae297c6.pdf
    • https://cdn.sqhk.co/bajafigotuvi/vihLswT/universal_steering_wheel_for_ps4_and_xbox_one.pdf
    • http://mipexalazalekab.getenjoyment.net/gajul.pdf
    • https://cdn-cms.f-static.net/uploads/4414166/normal_6032c580e8530.pdf
    • http://mosuxuvemuzuwex.mywebcommunity.org/53720686100.pdf
    • https://cdn-cms.f-static.net/uploads/4423428/normal_5fd1f929a70cc.pdf
    • https://static.s123-cdn-static.com/uploads/4476577/normal_5ff2bc4dc5767.pdf
    • http://zisapawiwako.mypressonline.com/koputuxob.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7d03cc37-11e7-493d-8158-7482f653bf29/traditional_wing_chun_-_wooden_dummy_training.pdf
    • http://zulolabopel.myartsonline.com/naveximelofozezogifokokod.pdf
    • https://uploads.strikinglycdn.com/files/63dbde2d-b1e1-4aa8-805a-f2bf643b12d2/kufuzigubap.pdf
    • http://mevumum.epizy.com/sekaxod.pdf
    • http://werewipabelud.rf.gd/how_many_atoms_are_in_mgso4.pdf
    • http://dikowipenov.epizy.com/assignment_problem_download.pdf
    • https://uploads.strikinglycdn.com/files/08e2ae41-3b6b-4f4f-92d9-f84b07116255/41505660027.pdf
    • https://uploads.strikinglycdn.com/files/0ffae30b-cb31-46e8-b7eb-b0227e43576a/phantom_of_the_opera_ending_meaning.pdf
    • https://uploads.strikinglycdn.com/files/049e92cc-ccc3-4233-aeaa-595e6bdb0860/o_que_a_poluio_da_gua_pode_causar_aos_seres_humanos.pdf
    • https://uploads.strikinglycdn.com/files/5d5f2645-a7d3-487d-9ac3-7cfc1d3b852d/dipovidobinonabipipi.pdf
    • https://uploads.strikinglycdn.com/files/77999b72-2301-4b09-b5b3-ae72c258db4c/mimideniwafiwilefexoxerek.pdf
    • http://pilukakir.epizy.com/87479266463.pdf
    • https://uploads.strikinglycdn.com/files/d8f9efbd-1060-4944-99ae-d16f9dce8516/vezovesudujulujuworur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f835.bin
a026b79528c9d5e4a9e5db84b55c07d2534e31791272949702f2c645c0ae2c86		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF835 5120 bytes
font_01_sfnt_off000109d4.bin
7b32bb75d306b94799b9b629f92d0e5ae9df89444fd9fc2d4a9482bfe22aa4aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109D4 12360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.