Malicious PDF — malware analysis report

Static analysis result for SHA-256 98ddb405527324d7…

MALICIOUS

PDF

87.6 KB Created: 2021-04-02 01:03:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44b5b5abaded025a6b7dbc85d9aa0ccb SHA-1: da48f628ab5fc723ecf17149455474d33753ebb4 SHA-256: 98ddb405527324d71406b0b9d3ce5597bb7cd043db701166d4c3a8af6192ce3c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'maypoin.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'labor unions worksheet answers', indicating a social engineering attempt to trick the user into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=6.5+the+rise+of+labor+unions+worksheet+answers
    • https://static.s123-cdn-static.com/uploads/4388063/normal_5ff621ad32f2a.pdf
    • https://static.s123-cdn-static.com/uploads/4474450/normal_5ff9c942ee58d.pdf
    • https://cdn-cms.f-static.net/uploads/4427795/normal_606018c7460eb.pdf
    • http://shopeuro.pro/famalopuleso3ktsm.pdf
    • http://onsideball.info/how_much_does_a_public_management_earnhco14.pdf
    • https://cdn-cms.f-static.net/uploads/4424997/normal_604db44208598.pdf
    • https://cdn-cms.f-static.net/uploads/4421224/normal_6051ef405c9fb.pdf
    • http://creditstar-kabinet.com/tcpdf_codeigniter_not_workingv6dpx.pdf
    • https://cdn.sqhk.co/xovikojux/hgiijie/turbo_river_racing_apkpure.pdf
    • https://cdn.sqhk.co/lanumakefu/mgclzVz/mujuzaninikobokam.pdf
    • https://cdn-cms.f-static.net/uploads/4451565/normal_6043505462317.pdf
    • https://cdn.sqhk.co/pibusupi/eC5oibS/cinema_box_light_argos.pdf
    • https://static.s123-cdn-static.com/uploads/4479462/normal_5fe1c75121fb8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/8c56dbe1-4c81-47b8-8ce6-30c85c65eaf3/zenerawexezifemira.pdf
    • http://faleferesevo.onlinewebshop.net/28244680388.pdf
    • http://fuvamawijivef.atwebpages.com/activator_methods_protocol.pdf
    • https://uploads.strikinglycdn.com/files/2059249b-f076-4f64-8a67-906f277b40b6/whirlpool_thin_twin_water_wont_drain.pdf
    • https://uploads.strikinglycdn.com/files/8653c677-98f1-4bd3-a3c1-602147809d82/novela_doa_barbara_personajes_principales.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e823.bin
f1784a62a1b1129ae8591d67bfebd5438e1b4feb99d194115b679d1ff16f2f65		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE823 5248 bytes
font_01_sfnt_off0000f9ff.bin
af080404b32824b70af5dd5034dd07475d20d79f8bef2c4fd9df263a0d436778		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9FF 2820 bytes
font_02_sfnt_off00010663.bin
5bff8c9a48bf78f9956242c18c83625d89301e058992d6aa21613ee887a3e3ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10663 11016 bytes
font_03_sfnt_off00012bef.bin
de20f7145e627f1471ffd8e1cf92b063231062a008cf9bd97c86bb896538f0ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BEF 16368 bytes
font_04_sfnt_off000141a7.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141A7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.