Malicious PDF — malware analysis report

Static analysis result for SHA-256 9991771908f59d8a…

MALICIOUS

PDF

96.7 KB Created: 2021-07-18 05:00:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: b776efb54d2cbc5d5edcc9842297a7a1 SHA-1: 589bdbcd50010fa21a42ff564227d393b5b6e01c SHA-256: 9991771908f59d8abc4c1c2589ef20e7fa8d5582532ced0af166a385a7fd2b07
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The ML classifier and ClamAV detection strongly indicate maliciousness. The PDF contains embedded URLs, suggesting it may be used in a phishing campaign or to lure users to malicious sites. The presence of PDF-specific heuristics like PDF_URI and PDF_DUPLICATE_OBJ_BODY_INCREMENTAL, combined with the high risk score, points towards exploitation of PDF vulnerabilities for client execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/uzX87CUNjRg/square?utm_term=indian+parrot+life+cycle
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f0a7cfb45b7337311aca96/1626384335351/26343543101.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f02410086977531730b77d/1626350608443/golf_courses_near_me_within_50_miles.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f2435851c2e86098453b47/1626489688898/durozevokix.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e8f336309bd63f3d840cdb/1625879350843/jepuvemugosanifuminen.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e961dcdc37083541baa964/1625907676929/53417038637.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f0a057466a45133876273c/1626382423827/fojudibujojireba.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ee54b5b1f8b95648875637/1626231989664/jonupejipi.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e785b67ef31d0d76ee00ba/1625785782279/hungry_dragon_mod_apk_unlimited_money.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f07afb98e33d2cebbf03b1/1626372859319/6384911827.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e7ab814d2175279d10ecd1/1625795457632/40247350071.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f37554a047b6361226c547/1626568020778/12_cups_equals_how_many_pints.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011acb.bin
10a97741e7c4ec907ced6e00959dd82916ca989a15ee682b513c57565d5acbe0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11ACB 16700 bytes
font_01_sfnt_off0001465a.bin
0a39979269c2e438e822e43da04664d7dfc673d5d1a11e4879b80df6842ab6d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1465A 10512 bytes
font_02_sfnt_off00015e5d.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E5D 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.