Malicious PDF — malware analysis report

Static analysis result for SHA-256 911fefdef41ef5f7…

MALICIOUS

PDF

74.1 KB Created: 2021-02-12 01:02:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 177599f44275aa3c1816a0d07ee53a12 SHA-1: d772f04c8765bdad24204af9c0d5fc3f5fbde411 SHA-256: 911fefdef41ef5f704d1e221c96ef2228ceed614d3d288307cea5b3e6a80d8a8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL that mimics a search query for 'Regents biology digestive system lab answers', likely intended to trick users into visiting a malicious site. The PDF structure and embedded URI heuristic further support the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=regents+biology+digestive+system+lab+answers
    • https://cdn-cms.f-static.net/uploads/4411944/normal_601a418924314.pdf
    • https://cdn-cms.f-static.net/uploads/4470835/normal_5fdb010220469.pdf
    • https://static.s123-cdn-static.com/uploads/4369332/normal_5fe133736e91b.pdf
    • http://senteber.site/312084758649uq7g.pdf
    • http://bizarur.iblogger.org/bilbao_map.pdf
    • https://static.s123-cdn-static.com/uploads/4448558/normal_5ff758a6a59bc.pdf
    • http://vash-komfort5.ru/manual_blood_pressure_cuff_sizeso8dsx.pdf
    • http://idslim-italia.site/53902195849exi2q.pdf
    • https://cdn-cms.f-static.net/uploads/4478687/normal_5fd7091dca153.pdf
    • http://top-agent.ru/23649700537ls3s9.pdf
    • http://dibowofu.22web.org/pfas_drinking_water_guidelines.pdf
    • http://bestcreditcheck.info/magic_map_twilight_forest9olaj.pdf
    • https://static.s123-cdn-static.com/uploads/4454681/normal_5fdf9cc5bd7aa.pdf
    • https://cdn-cms.f-static.net/uploads/4392668/normal_601a493995a6e.pdf
    • https://static.s123-cdn-static.com/uploads/4409098/normal_5ff854600a4f2.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fadifisevak.epizy.com/cluster_headache_guideline.pdf
    • http://nodibuxirojijok.epizy.com/37052432115.pdf
    • https://s3.amazonaws.com/gapivegek/filariasis_pathogenesis.pdf
    • https://s3.amazonaws.com/poresi/13279781770.pdf
    • https://s3.amazonaws.com/xebuvuwov/dajulajomiwutejejo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcbd.bin
d31a6c76fdfb1279fd82e9b8de14b9e75b15dce9023afbccd6cb29ddbe621367
pdf-font-stream PDF embedded font (sfnt) at offset 0xDCBD 1708 bytes
font_01_sfnt_off0000e515.bin
1e49af75e7412b6cfea84cc9956e0c212851d4517a69c6a80fb316568b73cc96
pdf-font-stream PDF embedded font (sfnt) at offset 0xE515 5544 bytes
font_02_sfnt_off0000f7f5.bin
54c4b60c050147a683bf5ad8b0a0966507a93da44ef98dec4187602b7b40dbda
pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F5 10124 bytes