Malicious PDF — malware analysis report

Static analysis result for SHA-256 8af095a45d9ac537…

MALICIOUS

PDF

81.4 KB Created: 2021-07-22 00:00:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: ae0e5252bdfa80d1cf5cf22c8e29e39a SHA-1: adbf7b11785e09d8b71e43ecefe8afc95238f39c SHA-256: 8af095a45d9ac5374772fee2ce7be0898c4cdad916053eb60f8cdd6fa2db1766
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains heuristics indicating it is a phishing lure, specifically using an image to redirect users to a download. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and associated URLs point towards a phishing campaign designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9833

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/eaN1Eb74jJI/square?utm_term=rss+to+csv PDF link annotation
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f04434c57e07264c24ec2f/1626358837073/nsab_2000_norsk.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f11e2c96ce9b33d730578f/1626414636505/48165749640.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f88aeb5daaa92576c42146/1626901227926/satapugisa.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f2714d1db272198f8dfb74/1626501453892/5093255832.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ecab8be0914637f38ed097/1626123148070/lucifer_cage_the_elephant.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e90dad0a287971af993eb8/1625886125847/the_beginning_of_time_bible.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f532429c7c9f0ea9b091ef/1626681922543/volleyball_strength_and_conditioning.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e93ffe2a6f785f583557e7/1625899006083/kuludewopiso.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f18f27c5e45364ead60364/1626443560009/app_to_open_file_in_mobile.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f6bfcccd4b580eb849ab92/1626783692104/do_reptiles_have_warm_or_cold_blooded.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60efd507874a183f1c3ed0af/1626330375618/59231953142.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f0bf3906e5cb5c825edcd1/1626390330063/12532811165.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8f8ed19a9f87deb7120f0/1625880813141/80948607736.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f6a6f4f003fd3781f971c6/1626777332146/malerorapumabudijuwozok.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f63bcb514b21793b4dc700/1626749900123/79171772808.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e7d86cb977dd1475ca00b8/1625806956663/wuvubatesegep.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60edc9074ff81d3e2811a200/1626196231947/role_player_me.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f07d0093de1c7b8a0c68a9/1626373377064/12919023193.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f0a9699a456f4cc40a48cf/1626384745203/word_puzzle_game_with_answer.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f22c4aebca9b5ae8dfdc07/1626483786813/59227528987.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f88adbed32df628a59cfc0/1626901212000/i_have_feelings_for_you.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e7fef4d93aeb546a15eb14/1625816820655/55921040633.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f2068ed6eb890c0e4808d1/1626474126830/julutonawubotigeg.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f53c26c4d0d61e674e472a/1626684455263/56739903546.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8ecf32a6f785f5831cb1b/1625877747437/pisak.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f05aa8baa9e46167498bf8/1626364584783/83829550018.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE7D 16608 bytes
SHA-256: ded65132cb914d4bb31bf09af7787fe200b469399900c94171a17aab6f543d93
font_01_sfnt_off000109d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109D6 9700 bytes
SHA-256: cdee621fa5b342a27fc131290e4d9416477b71f5bccec402820f363082f8addf
font_02_sfnt_off00011f24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F24 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.