Malicious PDF — malware analysis report

Static analysis result for SHA-256 8df05dd347413ef7…

MALICIOUS

PDF

66.3 KB Created: 2021-02-05 20:02:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 8836870c5d0f2c0bb922cb8ababd72b0 SHA-1: 7b4f091a5391a33d30583a99655bd65e06701b80 SHA-256: 8df05dd347413ef72c1f6dc13b93439c328244e41b7c3e4d83eb109eee59ca18
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that uses a lure of educational material ('Four figure grid references worksheet with answers') to entice the user. It contains multiple embedded URLs, one of which is flagged as malicious and is likely used to download a secondary payload. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/aws?utm_term=four+figure+grid+references+worksheet+with+answers PDF link annotation
    • http://grampus-shop.com/11456955824ndt4n.pdfIn PDF document text
    • http://koolmaxt.online/30344835498resl3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467005/normal_5ff109673693d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500670/normal_5fe8e44a7c1df.pdfIn PDF document text
    • http://fly-drive.online/grand_theft_auto_vi_release_dateohcs6.pdfIn PDF document text
    • http://lnstagramlivesupportcenter.com/285112604921zn6g.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4410975/normal_6007df03b23a2.pdfIn PDF document text
    • http://moxolesapudeli.22web.org/7805069228.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450721/normal_5fcf7544af0cf.pdfIn PDF document text
    • https://serivuzoforin.weebly.com/uploads/1/3/4/3/134334639/waraban.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412900/normal_601307afed0b0.pdfIn PDF document text
    • https://zusikoxapumobib.weebly.com/uploads/1/3/4/7/134766975/9302382.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403119/normal_5fdf7eddec5ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383704/normal_600ebd4919f4b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dimakadube.epizy.com/1433552198.pdfIn PDF document text
    • http://runodeb.rf.gd/chase_checking_account_balance_sheet.pdfIn PDF document text
    • http://rufofexejojar.epizy.com/1133217310.pdfIn PDF document text
    • http://fefomopopokelo.epizy.com/tivozirelarisetufidawuda.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c698.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC698 5364 bytes
SHA-256: e60b0540e7e1cd23e5b2c89d68064e0646d6c778e128be24839baa2a7c99b232
font_01_sfnt_off0000d8ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8EE 10312 bytes
SHA-256: e9857ad1d91e27ebf6597fccb6c47b8425ab6bd187575227bdeda334da77c2a7

Open this report in the interactive analyzer, or submit your own file for analysis.