Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d40728f3a521c11…

MALICIOUS

PDF

91.9 KB Created: 2021-03-30 13:54:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 279cc3911f2992a21f63ff1d81d7d34d SHA-1: 757cc88bdaa18cea528e9e803c3150d66abf3a5f SHA-256: 9d40728f3a521c11170bcec917958d0194a37d323af5bed0839637cde61b3a88
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a phishing or malware distribution site. The document body, though heavily obfuscated, contains metadata suggesting it is a student guide, which is a common lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=animal+farm+student+guide
    • http://gagewetero.iblogger.org/27395601414.pdf
    • http://nutapobo.iblogger.org/buckie_high_school_uniform.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/1bc1dc04-bf2b-4ad4-aa1a-5fe8d4bb7e50/singer_futura_ce-350_embroidery_machine_manual.pdf
    • http://zemadepa.rf.gd/83879003974.pdf
    • https://uploads.strikinglycdn.com/files/9ef81da8-d552-4d71-ab95-24917b592485/podevulixozurojir.pdf
    • https://uploads.strikinglycdn.com/files/6f8edde1-904f-48ea-960e-2b3c0c9ef44d/rulekavevew.pdf
    • https://uploads.strikinglycdn.com/files/9565d7ff-d34b-4435-b2b4-a9d14b498b34/can_fl_studio_run_on_a_chromebook.pdf
    • https://uploads.strikinglycdn.com/files/0fd52841-0e6b-4d68-b974-13ec0d176fd9/how_to_turn_on_pebble_watch.pdf
    • http://xusasun.rf.gd/krishna_aarti_bhajan.pdf
    • https://uploads.strikinglycdn.com/files/014074e5-6310-44c4-8494-938b0024569a/76062272896.pdf
    • http://dafudezukixoz.epizy.com/carol_of_the_bells_wilhousky.pdf
    • http://karezijejot.rf.gd/mimilukuna.pdf
    • https://uploads.strikinglycdn.com/files/9f03fbd7-37a4-486e-a052-3c35a69fe861/49137658522.pdf
    • https://s3.amazonaws.com/bidemewufa/how_much_does_an_intern_earn_in_south_africa.pdf
    • https://uploads.strikinglycdn.com/files/007ceb5f-c9fb-44c5-950f-70245b620640/what_is_the_best_over_the_range_microwave_convection_oven.pdf
    • https://uploads.strikinglycdn.com/files/7e3102ca-6df6-470c-a570-2bb9f8a5cd4e/rubogowigapizadekivixa.pdf
    • https://uploads.strikinglycdn.com/files/de9e9ef0-2cfd-4e47-a026-95266c295530/what_does_visually_aesthetic_mean.pdf
    • http://fiwemigusa.rf.gd/waluvaxugajilisab.pdf
    • https://s3.amazonaws.com/metakibeme/dionysius_the_areopagite_mystical_theology.pdf
    • https://uploads.strikinglycdn.com/files/cec7aa03-3f1f-4541-806a-cf91b25c51cd/kushiels_dart_chapter_summary.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011be3.bin
8543388e3a3240d2cb11e12f838aa30a6dda08410357e7d8fc5306ef883ab919		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BE3 4988 bytes
font_01_sfnt_off00012ca7.bin
9d654d18536f25ab97c4d19b2524c093fabdb830a7ae40b76fb96679a28385ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CA7 11824 bytes
font_02_sfnt_off0001548a.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1548A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.