Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c3380b4ffb03724…

MALICIOUS

PDF

77.4 KB Created: 2021-04-08 05:29:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 603cd4a8d1fc713d79c7364d0a993c1f SHA-1: ad17e006cf4d0d1afac462270f0b36135ca54838 SHA-256: 9c3380b4ffb03724c3c7c2662b47ebd9d156187994f47ec53073ed6a28f320cf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to a worksheet answer key.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=pushing+the+limits+sight+video+worksheet+answer+key
    • http://gojawufeki.getenjoyment.net/yasin_in_tamil.pdf
    • https://vakexojukesazi.weebly.com/uploads/1/3/0/9/130969985/8938525.pdf
    • https://cdn-cms.f-static.net/uploads/4406213/normal_5fe8dc5376b2f.pdf
    • https://cdn.sqhk.co/sofilita/jjfjewQ/pes_card_collection_legend_fragment.pdf
    • https://cdn.sqhk.co/resesexiraf/gfyjekt/crash_web_series_mx_player_imdb.pdf
    • https://cdn-cms.f-static.net/uploads/4474449/normal_60292a15308e5.pdf
    • https://bigevavez.weebly.com/uploads/1/3/4/0/134016854/lajusavubo-zaxatiwi-jisuzavukudebun-zofimijoperila.pdf
    • http://xutexukoxobofi.mywebcommunity.org/nagetatitomerinuru.pdf
    • http://bukenisefino.mygamesonline.org/english_grammar_notes_in_tamil.pdf
    • https://cdn.sqhk.co/ridijafugemi/j8ggLhc/hello_neighbor_game_free_app.pdf
    • http://pusapulavudajuz.22web.org/professional_development_goals_examples_for_occupational_therapist.pdf
    • https://waxifititisapo.weebly.com/uploads/1/3/4/3/134363739/beff8d48d3b668.pdf
    • http://debagigitefofo.iblogger.org/99451724230.pdf
    • https://cdn.sqhk.co/xadeviro/gcyjhib/download_face_cam_avatar_face_emoji_mod_apk.pdf
    • http://ramawojapuka.iblogger.org/australia_train_map.pdf
    • https://static.s123-cdn-static.com/uploads/4393016/normal_5ffe9ab28860d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://36535336-4f9e-4c0a-b1ad-3385cb5d4299.filesusr.com/ugd/15ebe2_c00ce66d8a3a4e3aa3f4cb3b8409fccf.pdf?index=true
    • http://sumewapedujevi.rf.gd/how_do_you_know_what_size_water_softener_to_get.pdf
    • https://b304dada-1952-41b2-af44-d16a3232bb3f.filesusr.com/ugd/c19c34_4ab3ad32c5794dbf840fa277f038e03f.pdf?index=true
    • https://ec8c99fd-5413-4e38-b6a0-2ccbba71fc6f.filesusr.com/ugd/de02f3_d57cdfee6884463cb5f9ca7becd5546b.pdf?index=true
    • https://01d7ec8a-e38e-4e33-8c76-1be31754498b.filesusr.com/ugd/24d943_3aa14cda225c41a7ba1f52d25063ad94.pdf?index=true
    • http://dapibudajemuk.atwebpages.com/21907446016.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f166.bin
c952acdb206571cc35585ebf93b53d1d1a2a0a8a9421cf1c839967d262b48112		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF166 5560 bytes
font_01_sfnt_off0001043a.bin
30fac74841394682810336732439b4f8c3cdc4d5c0a62a91d7a674107fe85ade		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1043A 10672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.