Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e72d93d84e00ee2…

MALICIOUS

PDF

74.8 KB Created: 2021-11-11 15:56:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: af4ca3914d79749069ce58fdac3b84fa SHA-1: 066b145fd07ccb1c1ea0b0fbcbbcb7a06008890b SHA-256: 9e72d93d84e00ee263b3d2136110d7f9a6fb65ea20edf0aa6a3a35003adb649a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. The presence of embedded URLs, despite some being labeled as benign, suggests an attempt to redirect the user to potentially harmful content. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall context points to a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/7R6buoffwiA/square?utm_term=9th+grade+biology+textbook+pdf+miller+levine PDF link annotation
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d1917bf3ffa7570ed9718/1636636951523/order_of_operations_batman_worksheet_answers_algebra_1.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/618d08ef9dcab03ee0ea7fcf/1636632816143/all_types_of_fabric_names.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d0f5310d3b527d44e01c2/1636634451094/does_norman_actually_die_in_the_promised_neverland.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d0d42c2b0650e1c4da403/1636633923079/75175128555.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d090af30b90141a5492c2/1636632842954/minecraft_pe_ting_vit_min_ph_ios.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/618d0a2fdb06b4663fb496c1/1636633135738/legit_paypal_money_adder_no_survey_or_human_verification.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/618d1de14c5b9119e5f00fcd/1636638177367/how_to_make_an_infinity_sign_on_keyboard.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d1e9abed2564963eba7ab/1636638362128/homeostatic_imbalances_of_bones_and_joints_worksheet_answers.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d091f10d3b527d44da2ec/1636632863457/ako_uva_ashwagandha_churna_na_chunk.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d07527ba5a9399a3cbdd1/1636632402994/45058881491.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/618d0d22a2c96337bdc5906c/1636633890906/sodujekeladadibave.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d0d8dcd79e33780a71444/1636633997225/how_to_get_a_part_time_job_at_beef_bowl_persona_5.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf2a1a42a161bf6e52b8e/t/618d14d9a2c96337bdc6046c/1636635865403/4650793857.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d14edf0fb0228eabe85d1/1636635885409/digital_marketing_for_beginners.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf2a1a42a161bf6e52b8e/t/618d13bf02222e1c98e4af4f/1636635583973/clases_cristianas_para_nios_pequeos.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf2a1a42a161bf6e52b8e/t/618d157f3cc9cb50f422aa0a/1636636031446/how_to_make_cloud_shape_in_illustrator.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf2a1a42a161bf6e52b8e/t/618d1c0b60f440244bbc6481/1636637707275/21606139307.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/618d18ee9b4b8a27d5da9573/1636636910539/koxajamuzewibonajogezuze.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/618d0971106f700944911e0c/1636632945714/download_library_arduino_uno_proteus.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/618d1e0460f440244bbc8551/1636638212860/9.snf_fizik_soru_bankas_palme.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bd14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD14 17216 bytes
SHA-256: 37f41794e80be95d6bb33e9db9da4780108d0ef8711f1fb6bd39c382fd04683b
font_01_sfnt_off0000e959.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE959 11364 bytes
SHA-256: a2dbb611886c4b53377ea8bb2e92bf4a0c2291d97d76709ac824839b26539c1d
font_02_sfnt_off00010382.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10382 16540 bytes
SHA-256: 45015263e28dbf00792e0fa83ae0fb9123af5110209f191c00797c49350166ef

Open this report in the interactive analyzer, or submit your own file for analysis.