Malicious PDF — malware analysis report

Static analysis result for SHA-256 9995bc94462d24f4…

MALICIOUS

PDF

79.3 KB Created: 2021-07-15 18:05:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 10165f62f6881e3020294b0d34696f7e SHA-1: d3c76bf1a595bce12a7e749dfaeac161057408f9 SHA-256: 9995bc94462d24f4252c265388feef26551bbf1373f65c3926aca64442cf47d3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is identified as a malicious PDF by ClamAV and an ML classifier, indicating a phishing attempt. While no specific script content was extracted, the presence of embedded URLs suggests the document is designed to redirect users to potentially malicious sites. The PDF structure and metadata are consistent with a document crafted for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6556

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/k6oGaauGqGM/square?utm_term=how+to+make+anvil+in+minecraft
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60efdb95177a4e2836d1f804/1626332053308/32683848960.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec8617c8b0d544b6d7e364/1626113559383/marvin_hitchhikers_guide_to_the_galaxy.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e7c88a4aaab0286a89d21a/1625802890361/xijigosovuxazikiju.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4f2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD4F2 16792 bytes
font_01_sfnt_off0000ed09.bin
d848754162b4f92c3ae1716d7f661f0949b19fb2bc925ca4f7139c7b7df64dfc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED09 10564 bytes
font_02_sfnt_off00010517.bin
3564c3950ca0b4cb7fe9c331130ac1c7d3c0000269cf42ac7f3a0c1cadcb0acc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10517 16548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.