Malicious PDF — malware analysis report

Static analysis result for SHA-256 a40af1f9f282808c…

MALICIOUS

PDF

69.2 KB Created: 2021-05-30 20:26:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd1847df35f03e6b651b75bd7706acec SHA-1: 19a740105a8722efde11abb4b3198a96d0c4ddb5 SHA-256: a40af1f9f282808c4ff933ee4183d8374946ba4ca26e5ffd9a48ed0b5dbedbc0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF that was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to PDF files hosted on compromised websites, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to be a lure for free printable preschool flower worksheets, a common tactic to entice users to open malicious documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xn----9sbccjdbca7cyaieg1a3j.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/e7f961909bb3e7095a47aee7033762a4/6268880388.pdf
    • http://www.icodar.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b52480cb11---jezivejod.pdf
    • http://vote4dannybarry.com/clients/2/2f/2f5d4f67c16906f9b09010289963de11/File/86084604186.pdf
    • https://www.emmabowman.com/wp-content/plugins/super-forms/uploads/php/files/89b6f90c96eaccca3039f45325ced88d/76219261966.pdf
    • http://www.combatsim.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160abe7f6e4238---56383981068.pdf
    • http://adveotec.com/img/file/luniparokolobu.pdf
    • http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160814753b32f3---68590074881.pdf
    • https://movesforfree.com/wp-content/plugins/super-forms/uploads/php/files/6kqk3vl4me03m5akg3q4apobf6/68157778960.pdf
    • http://www.skupp.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160b2c78fdb414---25748819449.pdf
    • https://www.inkfactory.pk/wp-content/plugins/formcraft/file-upload/server/content/files/160b2b52898192---97198863022.pdf
    • https://fnb-concepts.com/images/uploads/files/55008679130.pdf
    • http://droprint.my/home/ququ4923/public_html/userfiles/file/tazejud.pdf
    • http://sushi-belovo.ru/files/20911994360.pdf
    • http://inlikeflintlogistics.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b2078cd8a2f---9874563853.pdf
    • https://takeorders.online/wp-content/plugins/super-forms/uploads/php/files/kiavtoc0cmnj9o74dbe1os74qq/138247306.pdf
    • http://stroynerud-sm.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607c58c999c9c---27603807924.pdf
    • https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/1o22pbtkk2jnp4s6pvu2512jq4/gemetopekurufulexopat.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=free+printable+preschool+flower+worksheets
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d258.bin
5ab13221db5a23ed11e6276a169b960bb968de9b883bff90522782264eca9db7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD258 5352 bytes
font_01_sfnt_off0000e49a.bin
6a2b9e0f39455c7d91dfd1b584439a4cac008bc442fd995445e6b5a9311dad7f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE49A 10448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.