Malicious PDF — malware analysis report

Static analysis result for SHA-256 90e1565e4a8af44c…

MALICIOUS

PDF

86.0 KB Created: 2021-07-16 17:19:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 136c7af38b16d1be167c1988e8141182 SHA-1: 277a45e8a82cfdfe0659168bc22d8cd8cfcb0309 SHA-256: 90e1565e4a8af44cd35b4ded0ccd2cb81d83cc15782b0b2ce74c17c4fea3a2e8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan threat. It contains embedded URLs that point to seemingly benign content, but the overall structure and detection suggest a malicious intent to redirect users. No scripts were extracted, limiting the analysis of specific execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5252

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/iXsW93xxTQA/square?utm_term=besties+forever+and+ever
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60edb09a262c1d4011367cb5/1626189978732/93810503111.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f03d474980ba6b3b72452a/1626357063880/38367230181.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e94a13cc7c086459280f27/1625901587535/love_marriage_and_arrange_marriage_line_in_hand.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e79dc9d93aeb546a10e174/1625791945501/sweet_bird_of_youth_full_play.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec89580d838b6c850d87dd/1626114392167/chicken_and_bacon_skewers.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e920772a6f785f58345b1c/1625890935560/sikegivazipoxad.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f070efd941835b1319ae7e/1626370287473/basement_for_rent_in_scarborough.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca91.bin
ee6d8c25003eb2de61ee1fda640ec7b8e4605923364b71ee832b966c85f0f81c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCA91 1780 bytes
font_01_sfnt_off0000d2f0.bin
333ac44a33a5f6cb5ae26ccbb7017378220f24410364d0c845124a64346401d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2F0 18816 bytes
font_02_sfnt_off00010324.bin
831e63f55fecb0b3d1e0019ec2c109827478611dfb210189d50957eece711945		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10324 16424 bytes
font_03_sfnt_off000119b9.bin
6741ec1b2471580610809bda8a6f8f0f3c4c5870e3a3f045fd3acb16b119753a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119B9 10420 bytes
font_04_sfnt_off0001318f.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1318F 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.