Malicious PDF — malware analysis report

Static analysis result for SHA-256 99d87a21e4c20dd5…

MALICIOUS

PDF

170.5 KB Created: 2021-05-20 01:26:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 5ace3e9ab596987c2812be7c8740bee7 SHA-1: d0151b30c1be33e4a7e04392c82f015bb067bd66 SHA-256: 99d87a21e4c20dd54497de1aa83daf6fb806149ab17bb8b0de4a402674ef687b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that directs to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, appears to be a lure related to textbook search results, suggesting a phishing or credential harvesting attempt. The presence of an external URI and the ML classifier's high confidence further support this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=general+chemistry+principles+and+modern+applications+slader PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4456387/normal_606b42a873272.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405687/normal_601cad49e2b78.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410714/normal_5fdc114601186.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385862/normal_5fedfebb4edd9.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dudigonifu/ferrari_f40_engine_sound.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/109211d6-f508-4701-b670-607704b3f1b5/how_to_screenshot_on_lg_v60.pdfIn PDF document text
    • https://s3.amazonaws.com/kaxukok/lusofirejadelewavu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d94bf9d-5b80-4d59-80e1-3bb2c805e5ac/90316665261.pdfIn PDF document text
    • https://s3.amazonaws.com/kubedukowug/bewexud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e12ab64-3495-41bf-bc0d-ea7a55732f68/java_api_for_restful_web_services_example.pdfIn PDF document text
    • https://s3.amazonaws.com/sugosubexez/ruger_lc380_disassembly.pdfIn PDF document text
    • https://s3.amazonaws.com/nisiwanolom/ieee_uat_test_plan_template.pdfIn PDF document text
    • https://s3.amazonaws.com/vovuzize/ritofobaxanipotonaliwago.pdfIn PDF document text
    • https://s3.amazonaws.com/zemunomipazikez/zuwalunixoduvorave.pdfIn PDF document text
    • https://s3.amazonaws.com/kabisebax/toxoplasma_gondii_diagnosis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/29bab88d-0f41-4d30-bb35-1dd3010584b1/computer_science_illuminated_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3f6ba31-4c0a-42e7-aacf-2d3ccae04e23/logutunufopuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c7e1359-e74d-4d5a-974b-fe875fc640c7/goreboneb.pdfIn PDF document text
    • https://s3.amazonaws.com/muvemasoxaji/cdc_brucellosis_reference_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4eab2233-40e6-4183-b067-c01aaffb9644/kokaxabufemide.pdfIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/zojuxopujati.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/71272110482.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024394.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24394 9712 bytes
SHA-256: 9b456f89406068ee17b7db3287961d4048f7a4637def47ddd0454395ea3035d0
font_01_sfnt_off00025e60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25E60 5448 bytes
SHA-256: 228d129df8684bf9435a3c8e438c3383bf54241845155c4b4ddebdfdfd39061e
font_02_sfnt_off000270c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x270C1 12632 bytes
SHA-256: 546b72d82a24a8d4d7b4e70f2a1d69c7c66cdd15658f22cb3c2eab9c02f9ebc9

Open this report in the interactive analyzer, or submit your own file for analysis.