Malicious PDF — malware analysis report

Static analysis result for SHA-256 93dbcf1e9ec067fd…

MALICIOUS

PDF

76.5 KB Created: 2021-07-15 20:32:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: b5b27358e2217e7fbbefa78bd45f7acc SHA-1: 2116afbfaed49060299ae63c107a320c0e8d64f1 SHA-256: 93dbcf1e9ec067fdd794f054d75dd2563a01eca99a49db6e54e1a9de5279a929
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains an embedded URI pointing to 'https://cructi.ru/square?utm_term=how+to+turn+preview+into+word', which is likely a phishing lure. While no scripts were explicitly extracted, the PDF structure and the presence of an external URI strongly suggest an attempt to redirect the user to a malicious site, consistent with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/square?utm_term=how+to+turn+preview+into+word
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e932e90a287971af9a8e64/1625895657869/20404293098.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60edfb28d6548a387fd626ec/1626209064580/the_handbook_of_competency_mapping_by_seema_sanghi.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edf6031c6c1a61d527901c/1626207747280/87632293729.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ed0be836a7a57c1ceeddd9/1626147816949/numuselup.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60eda108b2cb0e52868a2c0e/1626185992767/25884052512.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60efeacebba06d2f3417c0f1/1626335951074/14656570659.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec93f451a87c5d75ad4880/1626117108832/avatar_airbender_fanfiction.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e874caafb4337c4834b517/1625846986716/where_to_find_deleted_video_on_android.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8cfd2bf13e579204b723c/1625870290236/12052263823.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec87de7e2b6271615bdd35/1626114014108/upholstery_northern_suburbs.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f04ad7cc361861d3d78c03/1626360535848/31744627970.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec78f6668ba31612b4f183/1626110198679/57872307932.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e817ffd93aeb546a16fdca/1625823231654/biodata_performa_for_marriage.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60eff6a1bae8d04216d53d45/1626338977534/95061858370.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cca0.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCCA0 16792 bytes
font_01_sfnt_off0000e4b2.bin
bfd39e287009a32c9e0d634d90b4c4d674ffc69bfb6a77a18347e689b4a3b03c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4B2 16168 bytes
font_02_sfnt_off00010e91.bin
462c8f215e87debe40d97a4c288c97378786843849119796e91e067f4cd9a7b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E91 10252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.