Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3630f88c3a0f505…

MALICIOUS

PDF

84.1 KB Created: 2021-06-01 20:03:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 95e2ea19605e36e3ff7c2cd4984c255c SHA-1: d00c993d7826a111240e492aa9d0ed5b1a220d37 SHA-256: a3630f88c3a0f505d4c78162aa9c097018e14db46ee310d736ff8ace4ab32115
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though partially garbled, suggests a lure related to 'learning and motor performance' to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/pbw?utm_term=aprendizagem+e+performance+motora+uma+abordagem+baseada+na+situa%25C3%25A7%25C3%25A3o+pdf
    • https://static.s123-cdn-static.com/uploads/4445745/normal_5fcfb842e3ec3.pdf
    • https://cdn-cms.f-static.net/uploads/4411219/normal_6017b33987c05.pdf
    • https://static.s123-cdn-static.com/uploads/4455185/normal_5ffe8f39ced18.pdf
    • https://static.s123-cdn-static.com/uploads/4474997/normal_60013cffb82c9.pdf
    • https://teribizekejuxes.weebly.com/uploads/1/3/5/3/135391999/fapilamabub.pdf
    • https://siridadujaxata.weebly.com/uploads/1/3/0/9/130969300/fogojujul.pdf
    • https://static.s123-cdn-static.com/uploads/4466370/normal_5ff4e0694e6df.pdf
    • https://xumexutibivuw.weebly.com/uploads/1/3/2/6/132680998/6361486.pdf
    • https://cdn-cms.f-static.net/uploads/4456134/normal_6037fddb252d6.pdf
    • https://cdn-cms.f-static.net/uploads/4465269/normal_600b474c9a3ae.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://togusan.pbworks.com/w/file/fetch/144427545/pezapekamezidobejejufapal.pdf
    • http://didaneguk.pbworks.com/f/wipobogofutamuxelulunebip.pdf
    • http://ziludezubeju.pbworks.com/w/file/fetch/144461814/are_delonghi_oil_heaters_safe.pdf
    • http://mudowomuxexo.pbworks.com/w/file/fetch/144422349/what_to_do_if_you_get_a_cease_and_desist_letter.pdf
    • http://vamafob.pbworks.com/f/valores_normales_de_los_signos_vitales_en_adultos_mayores.pdf
    • http://fevosezew.pbworks.com/f/tusosevawemabamu.pdf
    • http://zufumegi.pbworks.com/w/file/fetch/144424296/52087939418.pdf
    • http://zikupuzajix.pbworks.com/f/barlow_and_durand_abnormal_psychology_8th_edition.pdf
    • http://mifimoruzuwo.pbworks.com/f/celtx_download_for_windows_8.pdf
    • http://jopamedet.pbworks.com/f/29522272960.pdf
    • http://wiwedano.pbworks.com/f/98938601343.pdf
    • http://podixarutib.pbworks.com/f/cheats_for_gta_san_andreas_android_apk.pdf
    • http://wozixokumo.pbworks.com/w/file/fetch/144440706/magic_bitter_magic_sweet.pdf
    • http://sizolasipape.pbworks.com/w/file/fetch/144411414/palabras_agudas_llanas_esdrujulas_ejemplos.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9c6.bin
45de2d41038742d47563c525684778e4d0804a6ad9c32a318353766c4864472b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9C6 6120 bytes
font_01_sfnt_off00010dab.bin
991f7ef292b59849fa1804c361c52a6255426db797fbcab3b5d31d1f34ee76c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DAB 2116 bytes
font_02_sfnt_off00011756.bin
66897922442390dc12f65892b1bc372cd42b813e943f22272ff629f04576f6b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11756 13412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.