Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c1e964562d35d0f…

MALICIOUS

PDF

71.0 KB Created: 2020-12-14 06:58:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: e8f2274e708f93af905b57d965c33b81 SHA-1: dbad132231d1f6fd80d4afbd822b7803686880ea SHA-256: 9c1e964562d35d0ffcc2552b8347470a4cd49b11900aafad0ecc0a3f280e81cf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to an 'answer key'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=locating+an+epicenter+lab+answer+key PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc581231452f90b7f043f90/t/5fd099612f29925fbb5283bd/1607506275241/car_driving_school_simulator_mod_apk_obb.pdfIn PDF document text
    • https://s3.amazonaws.com/sasufufa/gel_nimbus_16.pdfIn PDF document text
    • https://s3.amazonaws.com/bopuxosavubare/minion_rush_apk_download_latest_version.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce1af54a55824081a5be69/t/5fcf217757846c5b834fb744/1607410040287/47980548138.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4cc09d793648408463e0/1606372545360/32305647202.pdfIn PDF document text
    • https://s3.amazonaws.com/bajuse/business_plan_sample_word_template.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6b2965bcb0228a2ab1122/t/5fd2019fae71ea6dd3247b96/1607598496630/dr_jun_kong_dallas_tx.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7af808c-aebe-4954-8754-dcb0019b2642/4747452393.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc541af24b06a7eb31c2be5/t/5fcb46d1a0b42e3566a554e2/1607157457831/fuxesiwuzakunifipesadi.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4db98b8467722f1ed36c9/t/5fc727243d56556d1437f655/1606887204951/bppv_exercises_pictures.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC2F 5228 bytes
SHA-256: 848213f36cb1ffe3708586af16e1a6a55a2c75eada85e11d401c329fa44538d2
font_01_sfnt_off0000de0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE0F 10272 bytes
SHA-256: bffa60b981e2672648e79a052a37a7bb8430ed02a4658644cdb339f6b22024f1
font_02_sfnt_off00010124.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10124 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230

Open this report in the interactive analyzer, or submit your own file for analysis.