Malicious PDF — malware analysis report

Static analysis result for SHA-256 92e0d9f013c8a3fe…

MALICIOUS

PDF

90.9 KB Created: 2021-04-07 18:59:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7901bf64602e81cef7277c42096e898c SHA-1: cfa4e8031f903bcd54ac98daa4e82836d6b3d524 SHA-256: 92e0d9f013c8a3fe15d4dc58c43c29f8f31aec36e5005ef2d0327c2c001fc9d1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a lure related to a 'states of matter test answer key' and embeds a URL pointing to a suspicious domain. ClamAV and ML classifiers flagged this PDF as malicious, indicating a phishing or trojan-like behavior. The embedded URL is the primary indicator of compromise, likely leading to a malicious payload or phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=chapter+13+states+of+matter+test+answer+key
    • http://zutumufedige.getenjoyment.net/76552413005.pdf
    • http://vibolofisef.mywebcommunity.org/limezolaj.pdf
    • https://cdn-cms.f-static.net/uploads/4499282/normal_60638fbbe56a6.pdf
    • http://panixatexoxureb.22web.org/3d_bluebeam.pdf
    • https://cdn-cms.f-static.net/uploads/4476930/normal_5fd2c4d592236.pdf
    • https://static.s123-cdn-static.com/uploads/4426423/normal_5ffa870d861d2.pdf
    • http://renijulemigato.iblogger.org/bosonoga_bogini.pdf
    • http://matawobedopikam.mywebcommunity.org/calligraphy_writing_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e20d271a-53e3-41f9-9180-d6cd5f9fd148.filesusr.com/ugd/6cfc61_c91880d8452b4cb9b0be7a58f27908a9.pdf?index=true
    • http://pelebirepopo.onlinewebshop.net/toro_snowblower_replacement_parts_near_me.pdf
    • http://bigapenegig.atwebpages.com/longman_collocations_dictionary_and_thesaurus_free_download.pdf
    • http://xozelabudizi.epizy.com/unit_6_protein_synthesis_review_worksheet.pdf
    • http://nabafutig.myartsonline.com/saxirelejeda.pdf
    • http://muloluj.rf.gd/ackerman_steering_system.pdf
    • http://koxolavomuzo.myartsonline.com/barbarians_at_the_gate_summary.pdf
    • https://dc5ca969-d333-4582-9879-b719aca70d73.filesusr.com/ugd/760c43_44cc9a2624134cfbb7b7e1d1f87192c9.pdf?index=true
    • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_0384dce0556448c2b1e968e958e4572b.pdf?index=true
    • http://lipabarud.atwebpages.com/hot_beverages_recipes.pdf
    • http://nixevafuzija.epizy.com/subwoofer_bass_test_music.pdf
    • http://nibemodida.myartsonline.com/lefovirasojudoduken.pdf
    • https://9fbaa0db-fe9e-443e-b503-3d02ea494c21.filesusr.com/ugd/d417e9_ef6b65a02ddc41c2a72b9cc8c22be0e6.pdf?index=true
    • http://tulajadulixo.myartsonline.com/tojewax.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012466.bin
5f44eb5a5df76227400dc60a107057c0c328464af50c52a2228f01868e67786c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12466 5488 bytes
font_01_sfnt_off00013706.bin
dfdc8ca2a689cf62c34f93539590bdf8ccb7174a9da79e30d1c07c29591ef571		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13706 11364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.