Malicious PDF — malware analysis report

Static analysis result for SHA-256 88769ddacebbafef…

MALICIOUS

PDF

78.4 KB Created: 2021-03-30 13:41:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5462e3699f166125891cec486f4469a9 SHA-1: 56e1d99f4fd105a79728126950c050ba08d27484 SHA-256: 88769ddacebbafef37cce7c9e183f57a0c55e622d1deb85c55f496fb0da09876
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL disguised as a search result for a worksheet. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The presence of an external URI points to the download of a secondary payload, which is a common tactic for malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=finding+the+hypotenuse+worksheet
    • http://axecheat7.xyz/82040838844onr72.pdf
    • http://sidazolomaw.22web.org/village_business_ideas_in_tamil.pdf
    • http://vukuradi.mygamesonline.org/reading_comprehension_3rd_grade_online_practice.pdf
    • http://zobotalemogi.sportsontheweb.net/how_much_do_interior_decorators_make_an_hour.pdf
    • http://natfreshik.fun/bitlocker_free_maccxu30.pdf
    • http://bit7.top/grindstone_lake_hayward_wi_fishing_report28lkt.pdf
    • https://janikopet.weebly.com/uploads/1/3/4/6/134690806/riwajiw_bokulofa_rodunerosegibe_juwonudeluxul.pdf
    • http://mizafaroremida.getenjoyment.net/ansar_vdp_job_application_form_2020.pdf
    • https://rerajegido.weebly.com/uploads/1/3/1/4/131407096/faridotif.pdf
    • http://rowowesofazov.medianewsonline.com/27510988798.pdf
    • http://tells.fun/rap_maker_music_beat_recording_studioxpl25.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b73db3ac-2e3c-475a-83ab-7f4668f00a8f.filesusr.com/ugd/80e8fa_1436bb9dbbe94b168e596884ac672cc6.pdf?index=true
    • http://jopakete.rf.gd/basic_korean_language_tutorial.pdf
    • http://tefetuzuzip.myartsonline.com/78196553504.pdf
    • http://bilunijo.epizy.com/89271097230.pdf
    • https://3ae4d138-4ba3-4962-98fb-1b98b40a6a82.filesusr.com/ugd/38062a_1b6404f9c5d9491cb7cbce33990d4748.pdf?index=true
    • https://7e073981-ad1c-4081-8dc0-76946ba36063.filesusr.com/ugd/c4f63d_f88c2268d04f48d3b32f0a16a55815f1.pdf?index=true
    • http://mulazukaga.rf.gd/116108415.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f450.bin
3d77b00cee223c5492fa9f8f0c0d8d4612017b1c546e787ed01ba9f4533d4703		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF450 5192 bytes
font_01_sfnt_off00010612.bin
424232218b8e8e7abb539ea2c3983708cc558b75ef0074946df1c7d14aaabfbe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10612 11272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.