Malicious PDF — malware analysis report

Static analysis result for SHA-256 81443669a04cea9c…

MALICIOUS

PDF

78.0 KB Created: 2021-07-13 20:01:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: c161384fbc35d86cbbb8c731746269f6 SHA-1: c3b80a9104b9df5d670f316778c279111500f70a SHA-256: 81443669a04cea9c21706add084789fb2fd8f9f1bb1ee27e1e2446943b1cad2e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a phishing attempt. The presence of embedded URLs suggests the document is intended to redirect users to external, potentially harmful, sites. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious intent to deceive the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/pL_UGxDroB4/square?utm_term=cheese+images+free
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e7a6f74b964f05b8453b9b/1625794295098/33737610811.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e94d1faa30721e65f06bbe/1625902367984/tefojiduvudo.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e9434a0a287971af9b0669/1625899851007/jukutoj.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec839c950202184f108b50/1626112924597/class_9_science_chapter_13_exercise_question_answer.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60edad1c3680ef421b56390d/1626189085021/lumefitufajezaritetabo.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec8d7cbcf8be39b505f97b/1626115452649/bidebopiwew.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e7ba8f6e46386ca3becfb2/1625799311435/download_gameloop_for_call_of_duty.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e94a08b10b9b33fa98fd8a/1625901577104/how_to_cast_my_android_phone_to_my_smart_tv.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec912a3080d76c7a51ca33/1626116394449/ankle_pain_after_walking.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edb66b5dd1eb1c29090868/1626191467957/conversion_fahrenheit_to_celsius_worksheet.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e92c105fa2eb14b90c2ee4/1625893904369/all_channel_communication_network.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d529.bin
1a0de8310bf1d670959b549f047273090e53b3307ab2328ee14b06ce9f6ba273		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD529 10324 bytes
font_01_sfnt_off0000ec6b.bin
6e858d942aa5eb66029481f6f9569399c3e88e64a1d9115d08ebacc7c87492df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC6B 15468 bytes
font_02_sfnt_off000113e7.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113E7 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.