Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f9213b6328eea90…

MALICIOUS

PDF

71.9 KB Created: 2021-07-12 20:53:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 4cf964b93d5956106387c431d18f0f04 SHA-1: dbeca59a631fcf08fd9f67f876262c37425842f0 SHA-256: 8f9213b6328eea90329f34a4afe23035d97a7e2e852170646423b1eef0d56026
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ClamAV heuristic identified this PDF as 'Pdf.Phishing.Trojan'. The presence of embedded URLs, even those marked as benign, suggests an attempt to lure users to external resources. The PDF structure itself is also noted as having duplicate object bodies, which can be an indicator of obfuscation or malicious intent.

Machine Learning

  • Nyx PDF Classifier clean score 0.1829

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/UZrB20b2Dcg/square?utm_term=lexicographically+meaning+in+c
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e9171c8ce0e10532d26afb/1625888540478/free_after_effect_plugins.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b96d.bin
40b506259360c62dc553a54433f5e09c698f6009fc6b23c0761196ff651c0dd8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB96D 10728 bytes
font_01_sfnt_off0000d1dd.bin
b33166d59ec0c9f4bcda4ef24742502a87f4720b1b729851f89548856a2acbe8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1DD 16272 bytes
font_02_sfnt_off0000fc35.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC35 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.