Malicious PDF — malware analysis report

Static analysis result for SHA-256 851f7fc38aa27afe…

MALICIOUS

PDF

78.0 KB Created: 2021-04-05 16:04:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 8d016e0e36781731850217e4db2b76eb SHA-1: 789ef9330fc6404a492d7fb5325def847c72f599 SHA-256: 851f7fc38aa27afef551631bcfce0d190a97e1fcd891d8e7f3fc2b6de0f672e7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text related to downloading a textbook, and an external URI points to a URL that appears to be a lure for this content. The presence of an embedded URL further supports the phishing or malicious download attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=human+anatomy+and+physiology+textbook+for+pharm+d+pdf+free+download PDF link annotation
    • http://miwewumexurigan.sportsontheweb.net/cardiopatias_congenitas_acianoticas.pdfIn PDF document text
    • http://relax35.ru/pilonowun4ej7d.pdfIn PDF document text
    • http://trackcreditscore.info/85035220089e371k.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kukalawewo.epizy.com/louise_hay_books_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3dbb4313-3e20-4161-a8b5-238c9d9acf9e/tintin_the_castafiore_emerald_summary.pdfIn PDF document text
    • http://nixutatafodozof.epizy.com/present_simple_present_continuous_exercises_primary.pdfIn PDF document text
    • https://s3.amazonaws.com/lososimap/jane_zhang_all_of_me_mp4.pdfIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/material_ui_css_stylesheet.pdfIn PDF document text
    • https://s3.amazonaws.com/bepukuba/jomijolixerajefuwelip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebe921a0-0287-4318-97b1-d09ce25ff35f/tejipakabesavi.pdfIn PDF document text
    • http://vavijiguzedimeg.epizy.com/competency_based_interview_questions_and_answers_police.pdfIn PDF document text
    • http://ziwatepubapusu.rf.gd/gajejenenapinil.pdfIn PDF document text
    • https://s3.amazonaws.com/semuxemakaw/how_to_write_a_business_proposal_example.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/494b328b-5e71-48b3-b4f3-ccf86e5c4aeb/a_concise_public_speaking_handbook_5th_edition_chapter_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec641e17-7116-4bab-bc21-f7c9c0d7adb0/how_to_brew_coffee_in_hamilton_beach_brewstation.pdfIn PDF document text
    • http://bovuzigaratufob.rf.gd/2018_ke_bol_bam_video.pdfIn PDF document text
    • https://s3.amazonaws.com/nedijowewoded/wu_tang_an_american_saga_episode_9_review.pdfIn PDF document text
    • http://zulugeka.rf.gd/banulivivavif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b12dd48-42eb-49db-a63f-8fef22167982/18017364478.pdfIn PDF document text
    • http://nibopinalilabaj.onlinewebshop.net/72926747708.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f09d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF09D 5880 bytes
SHA-256: a41440c043a4efad06a1b81944ef3a152e2dc635758eab652402b79bce13b875
font_01_sfnt_off0001048b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1048B 11100 bytes
SHA-256: cb90f3bf2961fc7a50a482e15e3973d73db0e016d75c053c0c1608c7e2f0d3cf

Open this report in the interactive analyzer, or submit your own file for analysis.