Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c54f05ca657b886…

MALICIOUS

PDF

89.1 KB Created: 2021-03-17 09:25:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3df08075a580cfca62a2e2fc0624e00e SHA-1: 93b1e3452fcdc0d0cbd7699548e811f09e7797f2 SHA-256: 9c54f05ca657b8862ccbe02bd272c7ac2a86edf3500af8d9afb969101f76312b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL that directs users to a suspicious domain, likely to download a secondary malicious file. The document body, though partially corrupted, suggests a lure related to educational materials, which is a common tactic for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=free+printable+comprehension+sheets+for+grade+3
    • http://salonlabs.xyz/44689121696s56i4.pdf
    • http://vvinorama.website/bitililerokelujmjgly.pdf
    • http://lenudes.com/betternet_vpn_apk_old_versioncyxt9.pdf
    • http://niwadeg.mywebcommunity.org/assembly_language_programming_of_8085_microprocessor.pdf
    • http://eu-study.ru/net_framework_4._0_3019_filehippoj35o7.pdf
    • http://universe1.space/comma_grammar_worksheets57cof.pdf
    • http://ledimpress.biz/clue_sheetslwvkd.pdf
    • http://taher-tcac.com/616296130070f5mh.pdf
    • http://springtea.space/uwc_undergraduate_application_form_2020_download06ne0.pdf
    • http://fobativ.mywebcommunity.org/50109911488.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/muvevanepen/itunes_manually_backup_iphone_greyed_out.pdf
    • https://s3.amazonaws.com/wovitiku/9650979989.pdf
    • https://s3.amazonaws.com/kavalukato/sobulexuziluderezi.pdf
    • https://uploads.strikinglycdn.com/files/19e4bb23-8edd-4d9e-a09f-f99d895767cc/fg_knot_tying_machine.pdf
    • https://s3.amazonaws.com/jiguwuzobozobaz/77414871544.pdf
    • https://uploads.strikinglycdn.com/files/56a3f73a-4cff-4c94-97ea-ec1104c8c351/24918043206.pdf
    • https://uploads.strikinglycdn.com/files/cb977bc2-c700-4add-b0a4-64e6c61a79fc/casio_g_shock_digital_watches_india.pdf
    • https://s3.amazonaws.com/lonozote/how_to_pair_big_blue_audio.pdf
    • https://s3.amazonaws.com/nosepevozux/sony_android_tv_55_4k_hdr.pdf
    • https://s3.amazonaws.com/zepifudoxapo/15474475562.pdf
    • https://uploads.strikinglycdn.com/files/efb09721-4280-4118-b7dc-ba59e7ba487d/plato_republic_greek_text.pdf
    • http://xuxerutiwuv.onlinewebshop.net/ranadijukigasejemosop.pdf
    • https://s3.amazonaws.com/lizuseguwix/clubmans_guide_west_yorkshire.pdf
    • https://s3.amazonaws.com/ladiwuzetawedi/laboratory_apparatus_chart.pdf
    • https://s3.amazonaws.com/zazelujeju/greenleaf_r._k._1970._the_servant_as_leader._westfield_in_greenleaf_center_for_servant_leadership.pdf
    • https://uploads.strikinglycdn.com/files/ee3baa24-5067-49e5-b291-e07e2b945c45/gugejitomuje.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011bea.bin
5a62599030ae9b00285aecbbb3c63c71fd46871420d4b56fa1c637b202c561a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BEA 5828 bytes
font_01_sfnt_off00012f8f.bin
6174de826386b554bbe8949cd512d799ece85e402bb9439d21c99d0a78c4a858		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F8F 10900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.