Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4e333583bd38a39…

MALICIOUS

PDF

78.3 KB Created: 2021-03-23 01:20:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ecb4e324ac7e118f6ae69f37847830c6 SHA-1: 23c9cc6f6a9013f1dc5f633d891303473702342d SHA-256: a4e333583bd38a39570d215f90353d7154de4395cd438869efc0e5b7db5d5120
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a URL that is disguised as a search result for an academic topic, likely to trick the user into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF. No scripts were extracted, but the embedded URI is the primary indicator of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=abstract+algebra+an+introduction+solution+pdf
    • https://cdn.sqhk.co/bitaxukezor/hbiagiY/14743902395.pdf
    • https://cdn.sqhk.co/letinumi/gjvjh1z/infobells_tamil_nursery_rhymes_free_download.pdf
    • https://cdn.sqhk.co/surodamiz/DJzidhh/8532015734.pdf
    • https://cdn.sqhk.co/sapamine/8gdhgji/beaumont_hills_public_school_uniform.pdf
    • https://cdn.sqhk.co/gofuzurafano/goRSqgi/planet_janet_scottish_families.pdf
    • https://cdn.sqhk.co/vinasujitupe/fRhdI7f/snail_battles_apk.pdf
    • https://cdn.sqhk.co/gorokipo/cXtjaHS/sujamevurokuzemibujam.pdf
    • https://cdn.sqhk.co/zivuwimavez/eYiiDgh/5850853151.pdf
    • http://kirademom.22web.org/how_to_roman_numerals_work.pdf
    • https://cdn.sqhk.co/vefomatakin/9hcggih/bajomurimupex.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/53850579-63bb-4345-9cac-c6f029aa38eb/cast_of_power_book_11_ghost.pdf
    • https://uploads.strikinglycdn.com/files/e47bd436-327c-4bae-bb93-b47e9392c875/why_isnt_my_furnace_humidifier_working.pdf
    • https://uploads.strikinglycdn.com/files/3f09fe15-df84-4be0-8366-e4bffc6d8169/wu-tang_an_american_saga_season_1_episode_7_online.pdf
    • https://uploads.strikinglycdn.com/files/835691e2-e48c-43ca-ba11-69300d812d63/area_of_irregular_shapes_worksheet_free.pdf
    • http://batapijas.myartsonline.com/betodulirewu.pdf
    • http://saraxafizopib.rf.gd/64042889911.pdf
    • http://faleferesevo.onlinewebshop.net/callan_method_stage_4_chomikuj.pdf
    • https://uploads.strikinglycdn.com/files/54b3d738-e0b4-4927-aebb-3ac39b00ffb9/apple_ipod_shuffle_charging.pdf
    • https://uploads.strikinglycdn.com/files/213ca8c4-612a-425b-9030-7b0aae5398b8/zesaribi.pdf
    • https://uploads.strikinglycdn.com/files/c30fd567-0d02-4f3c-88f5-7958ca65d3ea/67282261149.pdf
    • https://uploads.strikinglycdn.com/files/ca6fc5d1-14ec-41db-b714-2d1925cb849e/zeguxezexekiwit.pdf
    • https://uploads.strikinglycdn.com/files/68a6a959-f5d0-40ee-973c-4f853389b5e7/how_do_i_get_rid_of_my_wine_belly.pdf
    • https://uploads.strikinglycdn.com/files/eac22aa8-5901-4989-928f-78f6c94dcf6f/verizon_router_g3100_review.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f22f.bin
b6a44341e8a1c0214e33058b4d49135005ebfbb2345c54c2426254f2b6ab7a54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF22F 5452 bytes
font_01_sfnt_off000104c3.bin
7796613e5d7503e8212749416c541504253c4e7488a1556e8f8bee17ab2cae3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104C3 11420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.