Malicious PDF — malware analysis report

Static analysis result for SHA-256 a47301955be42c68…

MALICIOUS

PDF

79.3 KB Created: 2021-07-13 21:06:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 0654a6362251c8506b9638b5cc1ac500 SHA-1: 6e8d15898b2db10b6af3604ac197750d603cb31d SHA-256: a47301955be42c68a7ca54af3ec80754e7ce200e17d9180fa55e07d15c61fae2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The presence of embedded URLs, though many are marked as benign, suggests an attempt to redirect the user to malicious content. The wkhtmltopdf authoring application is unusual for a typical document and may indicate a custom-built malicious tool.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/-7-cX3opz_8/square?utm_term=what+does+my+daughter+call+my+aunt
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60edc695e6792c2552b84434/1626195605772/beyond_good_and_evil_meaning.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec7b6b950202184f0fa91e/1626110828008/the_law_on_negotiable_instruments.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e85b30dd097118f52f9dc3/1625840432825/butotubuvutenidepufafep.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec7b2d760c9e2bcf422cfa/1626110765566/80592438579.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec977be7718717d763ad62/1626118011454/what_to_do_in_factions_minecraft.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ed9ade8b02447bbddb2689/1626184414557/hotels_with_hot_tubs_near_me.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec9453478ebe26bfc6ea56/1626117203206/55428466735.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e8688f9e7b2b76b55b5f02/1625843856017/92981887447.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8b40d1b38cc0852604e00/1625863181113/26947236297.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60edc10a7ce58f02ed90a0cb/1626194186803/hydroelectric_power_is_the_second_most_popular_source_of_electricity_after.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec95734f2b1c51afa54c5f/1626117491475/bees_eat_nectar.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ec88b6dbb514329fafaaa0/1626114231063/forasorenozobizena.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec8f5436ee212f66cf6cba/1626115925195/david_by_michelangelo_meaning.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d31a.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD31A 16792 bytes
font_01_sfnt_off0000eb2c.bin
3700a095a9d903169dc82e26e6b02c98b4b9bae1994311d52d392a03239dd98c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB2C 17176 bytes
font_02_sfnt_off000117bd.bin
e951e39aaf9d017dbc92548c628c91325b1472246e185ac2fbe39cf1b9928cdf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117BD 10932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.