Malicious PDF — malware analysis report

Static analysis result for SHA-256 86df8c7c548da681…

MALICIOUS

PDF

85.4 KB Created: 2021-03-14 08:53:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 3a00c79d30bfa6f95fb82ba56acf4e1e SHA-1: 946dc6def74bb36dab77c39ea7e9e33205b2974e SHA-256: 86df8c7c548da681c26f3cda318cb7d4e2b07d4f6e0e917d04bbea51e442c4a5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and a machine learning classifier. The document body, though heavily obfuscated, suggests a lure related to 'functional skills maths worksheets', indicating a phishing or social engineering attempt. The presence of external URIs and the overall detection as a phishing trojan strongly suggest an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=functional+skills+maths+worksheets+level+1 PDF link annotation
    • http://dedekuwetom.iblogger.org/bootstrap_4_classes_list_with_description_download.pdfIn PDF document text
    • https://cdn.sqhk.co/zodavujera/jSQXkN7/bridebook_the_wedding_planning_approach.pdfIn PDF document text
    • https://cdn.sqhk.co/tizarina/icheoec/multiplayer_driving_simulator_mod_apk_all_cars_unlocked.pdfIn PDF document text
    • http://andyhong.blog/calling_application_for_androidpmr2x.pdfIn PDF document text
    • http://swiss-gear-top.xyz/bhoot_fm_2018_new_episodel349f.pdfIn PDF document text
    • https://cdn.sqhk.co/kevekelobivo/ifYb4je/cat_fishing_rods_for_sale_in_manchester.pdfIn PDF document text
    • http://table-wait.com/someone_like_you_piano_sheet_music_easydljkh.pdfIn PDF document text
    • https://cdn.sqhk.co/jezuleku/keAidhh/pacific_war_world_conqueror_2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/mulerux/glassworks_floe_sheet_music.pdfIn PDF document text
    • http://jijeledinevo.rf.gd/what_are_the_types_of_business_activity.pdfIn PDF document text
    • https://s3.amazonaws.com/tarizirefevifab/cauldron_lincolnshire_sausages_nutritional_information.pdfIn PDF document text
    • https://s3.amazonaws.com/peveziwoguxuzam/98584917846.pdfIn PDF document text
    • https://s3.amazonaws.com/wudibirewuduto/tcp_ip_illustrated_volume_1_1st_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/xuzakob/autograph_telugu_songs_free.pdfIn PDF document text
    • https://s3.amazonaws.com/kovibu/black_and_decker_mini_fridge_with_freezer_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/nitidadufetenu/what_atoms_have_the_largest_radius.pdfIn PDF document text
    • https://s3.amazonaws.com/negonanopix/lisebe.pdfIn PDF document text
    • http://wojemegakal.rf.gd/centering_and_shuttering_form_work.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/412dc91a-0b7f-464f-994b-76bdd9506d6d/world_geography_quiz_1_quizlet.pdfIn PDF document text
    • http://zawagebojirowe.rf.gd/adura_mi_ti_gba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/191bdb9b-d0df-4578-8ee9-46926be3dda9/23797137700.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e06cdd0-2bc1-4205-9cbd-98e33d72ed01/3511382795.pdfIn PDF document text
    • http://pixagikaw.epizy.com/class_1_english_grammar_question_paper.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101A0 5144 bytes
SHA-256: ca6bace2cc460d24c5679765e4d77e672dcdc06319490dbed8251add906a6aeb
font_01_sfnt_off00011309.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11309 10736 bytes
SHA-256: d126cd5a903475b44d149d30b1a37e067a052a7c75095f177d3b1ba7f5524e7d
font_02_sfnt_off0001379a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1379A 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.