Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ac3d106a6c1ae7c…

MALICIOUS

PDF

162.0 KB Created: 2021-03-14 03:30:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: faa4dbafde350b94e0fcdfc17b736efa SHA-1: 25711ad3f6f8aed69707c080fc6e9b186f134d06 SHA-256: 8ac3d106a6c1ae7c5760322f15debe64e656a6ca798a8e807b6cb991fb19195e
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded URLs and is flagged by ClamAV as a phishing trojan. The document body, though partially corrupted, suggests a lure related to an 'Illinois constitution answer key'. The presence of external URIs and the ML classifier output strongly indicate malicious intent, likely to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=illinois+constitution+answer+key
    • http://vagijuderotogur.22web.org/netiwudupurewo.pdf
    • http://leadtop.co/60083691805bsz42.pdf
    • http://the-english-temple.com/vampire_diaries_books_full_setw5zl2.pdf
    • http://uose.xyz/opencv_with_python_by_examplebt6qn.pdf
    • http://milanomoda-italy.website/lirexese0rowy.pdf
    • http://whalesqpa.fun/ethernet_cable_color_code_wikipediazxtfy.pdf
    • https://cdn.sqhk.co/votawusebak/wjbihiy/rubobifalovijovefi.pdf
    • http://recepty-dd.info/60167326795wleie.pdf
    • http://jobs-ingenieur.best/margaritaville_bali_frozen_concoction_maker_recipesanfku.pdf
    • https://cdn.sqhk.co/tajixixejafi/BicZB2C/fijumewokikivenuzinezid.pdf
    • https://cdn.sqhk.co/puzukebejas/cjeiehb/rupaxojefelajevewati.pdf
    • http://buylettersonline.com/rilaminixewutemi95988.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/294f9ee5-a2ae-43e5-b2ee-684bb815c27d/how_long_did_the_northern_renaissance_last.pdf
    • https://s3.amazonaws.com/xamibebulosaxug/nuwogad.pdf
    • http://vugopumoluzunu.rf.gd/bojataselurobilubu.pdf
    • https://s3.amazonaws.com/rewepalazamiso/78983426291.pdf
    • https://uploads.strikinglycdn.com/files/009aa189-b151-4f5a-b1f4-bfe6ee8f0a68/zuzinop.pdf
    • https://s3.amazonaws.com/muwemivumazulax/streamline_english_departures.pdf
    • https://uploads.strikinglycdn.com/files/8312bf3a-50c5-4d1f-b2ea-5a1dd8220f90/mosigigikedapam.pdf
    • https://s3.amazonaws.com/gadumagabusodel/93031912306.pdf
    • https://s3.amazonaws.com/paxivogedewilu/pearson_education_inc_3_answers.pdf
    • https://uploads.strikinglycdn.com/files/fa8953d5-c404-495a-a6ac-447cfb249b30/68881878624.pdf
    • https://uploads.strikinglycdn.com/files/bf046757-4db5-4941-97b0-5354b89b6751/can_you_take_your_drivers_test_online_in_georgia.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002430b.bin
fb006ef0f3694a56e42e34e7c17e6eb3dc8141dbce48f5da90c5f655644ef272		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2430B 4988 bytes
font_01_sfnt_off0002542b.bin
ee0f40c4a87c40babf2e2541476f938aedb706c84f77b2c875c10d085b3d0206		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2542B 11440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.