Malicious PDF — malware analysis report

Static analysis result for SHA-256 82dfc056d39bc66c…

MALICIOUS

PDF

108.2 KB Created: 2021-03-19 22:05:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b4afb4853035e1521181511794dfca4 SHA-1: d4dc0d99272ff2cce6f3963841af6ff76e4306ef SHA-256: 82dfc056d39bc66cb4a2945346f327c5f774ea8ef755bae93fb1a62589bfbdbf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs, one of which is directly related to the document's apparent subject matter ('graphene band structure'). The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest an attempt to redirect the user to malicious content, potentially leveraging a client-side exploit or a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=graphene+band+structure+pdf
    • http://pitushok.fun/streets_of_rage_1_cheats_sega_genesisyzen2.pdf
    • https://static.s123-cdn-static.com/uploads/4476578/normal_5fdc95eb1ddc3.pdf
    • https://cdn-cms.f-static.net/uploads/4423752/normal_602430b459f5e.pdf
    • http://mojuluxemo.22web.org/why_is_my_hp_3700_printing_blank_pages.pdf
    • http://hr-insider.com/22926587662woqmq.pdf
    • http://waystep.site/margin_of_safety_book_downloadfl469.pdf
    • http://exampl1214.com/scope_of_work_sample_templateja5t0.pdf
    • https://cdn-cms.f-static.net/uploads/4451035/normal_60465e3c671d6.pdf
    • https://cdn-cms.f-static.net/uploads/4455198/normal_60312b60c2fdc.pdf
    • http://suvopebitos.22web.org/bonove.pdf
    • http://pogadai.xyz/xerobd4a1p.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bezegoluzose/lagu_gratis_didi_kempot_suket_teki.pdf
    • http://kovoxajinuf.epizy.com/35574576871.pdf
    • https://s3.amazonaws.com/kuxegu/best_phone_without_answering_machine.pdf
    • https://uploads.strikinglycdn.com/files/0fbf35cb-3bb8-4bf0-84e4-7815fb705ecd/why_is_teaching_text_structure_important.pdf
    • https://uploads.strikinglycdn.com/files/4ecb0562-e5ea-4eb2-a262-b9e769d7e88d/p90x_food_guide.pdf
    • https://uploads.strikinglycdn.com/files/46768453-a83b-4125-9843-085454e86697/dell_inspiron_one_2320_power_supply.pdf
    • http://lulufakek.epizy.com/baldurs_gate_dark_alliance_ii_pc.pdf
    • http://pofitareku.rf.gd/rirajuku.pdf
    • https://s3.amazonaws.com/jalasilunaz/gjtl_annual_report.pdf
    • https://s3.amazonaws.com/lorerexeg/form_utility_meaning_in_marathi.pdf
    • https://s3.amazonaws.com/penefelomiju/foxosijugegipidimibow.pdf
    • http://nudegew.rf.gd/15656285976.pdf
    • http://lasuwutiganije.rf.gd/free_cover_letter_template_word.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014f32.bin
d32cb9c8b0e6254081e12bd5e582fed1e1bb4eee993ce3e0a764f5cf09d7fce3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14F32 5380 bytes
font_01_sfnt_off0001616f.bin
9b75e7a3c539e7ecbe6ca23e44b878cfb70443a965572a69c444e7a2b5e91937		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1616F 13236 bytes
font_02_sfnt_off00018dad.bin
49555b056eb1142e4ed36d60f7cd830a4860a586c3987347fabaa2e4f04fbe2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18DAD 16224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.