Malicious PDF — malware analysis report

Static analysis result for SHA-256 9820a216e6930bcd…

MALICIOUS

PDF

73.8 KB Created: 2021-03-28 09:26:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 701db2adcf7177197f1f4f76b48a30ca SHA-1: d1cb28cd340ac9b452314618759a06dc0a8ccae4 SHA-256: 9820a216e6930bcd993e813edac001b829ccd6b287c2e49faac89a2206b70ecc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to be a lure related to educational worksheets, which is a common tactic for social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=multiplying+and+dividing+monomials+worksheet+pdf
    • http://lipexifinidoda.scienceontheweb.net/cakewalk_no_sound_from_midi_keyboard.pdf
    • http://laithub.pro/cinderella_transformation_dress_tutorialc5o4o.pdf
    • http://tozaworewinox.mywebcommunity.org/67570793333.pdf
    • http://towonededuv.medianewsonline.com/the_coding_manual_for_qualitative_researchers_second_edition.pdf
    • http://geforiro.scienceontheweb.net/leronudoxofon.pdf
    • http://regvoolkim.website/samsung_smartcare_vrt_plus_washer_ur_code9bm36.pdf
    • http://begimewabifax.getenjoyment.net/83577112179.pdf
    • http://lebuvowune.getenjoyment.net/50920127378.pdf
    • https://cdn.sqhk.co/wenewojufaj/fdchgKm/rewards_program_translate_spanish.pdf
    • http://tobufupevujuma.mygamesonline.org/jee_main_b._arch_sample_paper.pdf
    • http://universe1.space/pofejejixabosazerijogukawf3js3.pdf
    • http://manibupefif.mypressonline.com/basic_concepts_of_object_oriented_programming_in_c.pdf
    • https://cdn.sqhk.co/zezetemirag/8cjjgfk/crosswords_with_friends_answers_june_11_2020.pdf
    • https://cdn.sqhk.co/dutedape/gdjashj/barobifuwonelagumebu.pdf
    • http://zipubezexupoka.mywebcommunity.org/epson_v370_treiber_download_windows_10.pdf
    • http://linavaluviriv.getenjoyment.net/94978399216.pdf
    • http://site-shop.xyz/counting_to_10_worksheets_for_grade_19vh4g.pdf
    • http://kilekapalovuzo.getenjoyment.net/black_gram_cultivation_in_tamil_nadu.pdf
    • http://zhenskiizhurnal.ru/spektrum_dx4c_compatible_receiversk4q6j.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sajomapujozokux.onlinewebshop.net/fojupofomugedoziz.pdf
    • http://vujijemu.atwebpages.com/muwixosesolaxolap.pdf
    • http://fukuselumetu.myartsonline.com/duvamafimegedimifukubal.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e057.bin
f9018f62d499ea2fa8536b0f0a1f7ddd20fe0e74404c4fa5bf43d1a9e522fb06		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE057 5780 bytes
font_01_sfnt_off0000f404.bin
9024e71d25d4b7c0301e317997384ed83a44b5b07bcd3d4997f353d2e8552543		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF404 10864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.