Malicious PDF — malware analysis report

Static analysis result for SHA-256 8df3a5d2828ad3e0…

MALICIOUS

PDF

70.8 KB Created: 2021-03-30 15:27:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3d894cebdea98b3f695953929cf119a2 SHA-1: 455ff037c8722bb53dbf18e5ce30e739a02d01fc SHA-256: 8df3a5d2828ad3e0b2eb8eecbf437c731c6f8b3f1f05664ec2ac4dd7b913fdd4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that mimics a search result for educational worksheets, likely as a lure. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were directly extracted, the presence of external URLs suggests the document is designed to redirect the user to malicious content, potentially a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=2nd+grade+suffixes+worksheets+pdf
    • https://cdn.sqhk.co/kinubowa/dhgddjg/95730213864.pdf
    • https://cdn.sqhk.co/dixajupuw/gJhjflh/39013604351.pdf
    • https://cdn.sqhk.co/fivufotimad/HTIjh3r/roblox_dinosaur_simulator_promo_codes_2019.pdf
    • https://cdn.sqhk.co/buzunonoj/hgjiEii/49114051078.pdf
    • https://cdn.sqhk.co/melipetoluf/0ihb2hh/the_stanley_parable_adventure_line_music.pdf
    • https://cdn.sqhk.co/gogojelawov/dDenhgc/clover_dating_app_ads.pdf
    • https://cdn.sqhk.co/nebafori/j7iaIic/desktop_tower_defense_2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f89bbc99-f04c-4c78-95c2-0655793314fb/great_and_mighty_is_the_lord_our_god_chords.pdf
    • https://s3.amazonaws.com/jazuravazaguz/91310146246.pdf
    • https://uploads.strikinglycdn.com/files/91ae561a-ac82-4fc1-8c53-52fab26615a0/japanese_vocabulary_list_school.pdf
    • https://uploads.strikinglycdn.com/files/23172452-ec4f-4890-b034-5b40a73f1461/dogozokusibe.pdf
    • https://s3.amazonaws.com/rutufokedizon/rue21_applications_to_print_out.pdf
    • https://s3.amazonaws.com/nosepevozux/breaking_dawn_part_2_movie_free.pdf
    • https://s3.amazonaws.com/firudegix/litufekuzesewor.pdf
    • https://s3.amazonaws.com/lakadutof/92660881575.pdf
    • https://uploads.strikinglycdn.com/files/6888f2cc-1bc8-4e5e-b9b6-c60cb2335b40/27722921590.pdf
    • https://s3.amazonaws.com/nolarifaforuxop/bachianas_5_partitura.pdf
    • https://s3.amazonaws.com/kumasala/survival_movies_list.pdf
    • https://s3.amazonaws.com/bidemewufa/journal_of_theoretical_and_applied_physics_template.pdf
    • https://uploads.strikinglycdn.com/files/beeee4a6-b631-4b61-b953-31818b2efc9d/18112015687.pdf
    • https://s3.amazonaws.com/towakog/the_laugh_of_the_medusa_sparknotes.pdf
    • https://s3.amazonaws.com/voxulija/67504305162.pdf
    • https://s3.amazonaws.com/sazariwapa/85598871108.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d78a.bin
a15d4923c3652f9c33e5a151c7d56445c277d19f41d1fe7bc4331b3d7e2a8e17		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD78A 5532 bytes
font_01_sfnt_off0000ea76.bin
b180280d3af9d0bfffbd49f8a45ff5ee2094c43d966bd2ce063a6f1a4b5a9619		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA76 10304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.