Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fc0e4ce87d25844…

MALICIOUS

PDF

124.2 KB Created: 2021-07-22 01:50:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 385273a8add2f67e9965015d52f9bf14 SHA-1: a76f1742fb003118d1396796c62c3e1c28b8e3dc SHA-256: 9fc0e4ce87d25844e8143b4763395007d2a0bd3b13c8b86886216dc1c1da3051
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs, despite some being marked as benign, suggests a phishing or payload delivery attempt. The PDF structure and embedded artifacts do not reveal specific scripting languages, but the overall context points towards a malicious document, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/k6oGaauGqGM/square?utm_term=chronological+order+of+dragon+ball+series+and+movies
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f0553487ee3075eb509f83/1626363188527/eroded_meaning_in_english.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e95ef6b9b95949b66094ce/1625906934460/jugibava.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec7984c268f363b085c13a/1626110340426/ramovalorore.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee31597dee9f188f77cd4c/1626222937759/game_launcher_android.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f88fa0d0dad67a22d25fd5/1626902433143/super_easy_meal_prep_ideas.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f02c9d0dea5e4896bf45be/1626352797148/mokosepunilubatonomis.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ec7aa27a1add4dee1eb729/1626110626676/35617125897.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee32479b1e4d6a360c6f2b/1626223175893/bizitidumetarofewog.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f554ce23bf9c1bcafe4a32/1626690766915/constant_inner_dialogue.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f7033fb6e03376d10c81f4/1626800959260/96263442920.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ee6109df274736e0ade7b2/1626235145235/jeligibezememera.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f2f0acc2d40e67ec05bd26/1626534060215/ts_eamcet_practice_papers.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f40f8d6167905317e19e1c/1626607502052/93242243425.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f2f39080d83038fa7d534c/1626534800476/n5_financial_accounting_question_papers_and_answers.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f207787c06d275666d95a9/1626474360491/ministry_of_housing_and_urban_affairs.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f1e8772afbb3684ef97a49/1626466431835/intensive_and_extensive_farming.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f6569a0e346c3111570f16/1626756762123/courts_and_their_judgments.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f699d189f57b2d412a7820/1626773969978/meaning_of_pharisees_in_the_bible.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f8a15ce6d4d36da3a09876/1626906973019/fozurulibizuxonizinubumap.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e91c15db8bb141bad93106/1625889813197/cell_biology_quiz_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018280.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18280 16792 bytes
font_01_sfnt_off00019a97.bin
68df06aa94b2c2b7ca2a3e049b79b97c7eb35fbc763c53b4f66130787aea9b8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19A97 11060 bytes
font_02_sfnt_off0001b3f5.bin
579e133d53cb8758f2afe63a55725e1e27dcf58033e515d85a8be3832756e9a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B3F5 17448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.