Malicious PDF — malware analysis report

Static analysis result for SHA-256 81b18e056b2564ce…

MALICIOUS

PDF

86.2 KB Created: 2021-03-15 05:09:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f2a7849e3358d9f1b6a1493bd691400c SHA-1: d97abd9f2357993db39fed387c2501da8e8ca006 SHA-256: 81b18e056b2564ce78a63c85a9e350df2fad607cd2514c688a96e84244bfa200
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to a domain that appears to be a phishing lure for exam-related information. The document body, though heavily obfuscated, contains text related to 'Examen toefl ibt pdf', reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=examen+toefl+ibt+pdf
    • http://wigogaduxatinuv.iblogger.org/rapebifajonikibobomefezo.pdf
    • http://debodopox.iblogger.org/climate_graphs_geography_worksheets.pdf
    • https://static.s123-cdn-static.com/uploads/4481397/normal_5fe4b8d73c68b.pdf
    • https://cdn-cms.f-static.net/uploads/4446035/normal_5fdb264ed12d7.pdf
    • http://sdfsdfsdf.shaketorch.com/promega_transformation_protocol.pdf
    • https://static.s123-cdn-static.com/uploads/4381735/normal_5fcd888113332.pdf
    • https://cdn-cms.f-static.net/uploads/4369308/normal_6025f0b84c452.pdf
    • https://wirimodarezekas.weebly.com/uploads/1/3/5/3/135314182/0039cb3e45.pdf
    • https://suwekamepegatir.weebly.com/uploads/1/3/2/6/132682685/3325851.pdf
    • https://metidelesaweso.weebly.com/uploads/1/3/0/8/130813592/8631260.pdf
    • https://cdn-cms.f-static.net/uploads/4412607/normal_6047822a5ec29.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://likusikukir.epizy.com/hammond_1590bb_drilling_template.pdf
    • http://ruredat.rf.gd/become_a_tour_guide_abroad.pdf
    • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_96cfd21fb36047b18e6f488eb405e6df.pdf?index=true
    • http://virilos.epizy.com/anticonformiste_dfinition_larousse.pdf
    • https://uploads.strikinglycdn.com/files/e03e2d58-19a9-42c4-ab08-13aab8239415/2014_lexus_rx_350_hybrid_for_sale.pdf
    • https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_238a3472af204d349230dc55e082fa2d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/23f1f3a9-59b4-479a-8621-fdd24f470b59/5956145264.pdf
    • http://zojuwibiso.rf.gd/rt-n66u_vs_rt-n66w.pdf
    • https://2a403a33-5f6e-4534-96f9-742aa7325afc.filesusr.com/ugd/d2da83_97f9a9c381b5460791fc4a5a77f8585c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/153618ce-ea2b-4bef-a52a-88e1e4fe5d47/59988942030.pdf
    • http://zugujegezamuto.epizy.com/wutavi.pdf
    • https://eac5c218-d238-408c-98a6-8ff0ecbb25fc.filesusr.com/ugd/b1277d_d252ffc1c1e54539a00043a1f475247d.pdf?index=true
    • http://vurasoda.rf.gd/2167153424.pdf
    • http://dupivet.epizy.com/advances_in_behavioral_finance_volume_ii.pdf
    • https://c504e2ef-f928-4e80-b5b1-fc05046f432e.filesusr.com/ugd/247f25_5d78b564e167445c83e0e0495435dd54.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d78.bin
d8e1f48db1502dee1cc84893d54a09cb2afe2c35c56349a374d20ed9bb5d822e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D78 5080 bytes
font_01_sfnt_off00011eb8.bin
ddb180786f6e9d7af4719279aec6ca895b797a1213048cfcbfa417d11d5bf336		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11EB8 13172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.