Malicious PDF — malware analysis report

Static analysis result for SHA-256 a537742e2bed52a3…

MALICIOUS

PDF

96.5 KB Created: 2021-07-23 01:34:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 7aea0f42ef72443827d946d46b9d4d25 SHA-1: 014fef393c23abb969ad5d1f2409106ce3cad0aa SHA-256: a537742e2bed52a3e8eb38c40a89b22367d88f05c8b65544cccfb4eaaa543a9d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. No scripts were extracted, but the presence of the malicious URL is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/square?utm_term=mother+cat+and+kittens
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60eca3cd58d864752e042ce7/1626121165789/class_8th_rational_numbers_worksheet.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f9dda1cd0edf1d71993934/1626987937842/funogadasorezudidagedu.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f5b410f463987ad2cb34df/1626715152981/itil_operational_support_and_analysis.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60edd816e635d71664611423/1626200086229/days_gone_trophies_list.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f946d1c2d04918d4c4bb63/1626949329547/7151411744.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8f1b583ae0c490236ea36/1625878965964/what_to_say_in_myself_in_interview.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f4d80a3a33e4096dededcd/1626658826586/41737961295.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec8b1ab6dedd3ae1699fda/1626114842844/31822178292.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f9e03759dd4545187558e5/1626988600155/bee_sting_swollen_and_itchy.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f4cdfdaba5f52989ba38bd/1626656253423/405277225.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60eda994ac23c31e62fe613f/1626188180373/how_to_write_manual_test_cases_for_website.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f4c395ce637c25834a7465/1626653589332/96334065734.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ed8ccaf84adf285bf4518f/1626180810272/appearances_are_deceptive_proverb_meaning.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f7920e38a0583738281f25/1626837518218/pipe_culvert_is_a.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e9034127127e680414a4ac/1625883457313/wubupapotaxapo.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f44af127519501fc1b3c86/1626622705639/css_to_scss_converter.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f8cbf8d35d04529b2a2a21/1626917881077/sum_of_products_in_excel.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ed23900124a666ff40c66b/1626153872325/15290440573.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8ca491102953de5830b8e/1625868873429/99932249906.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001168a.bin
7c84acd19ee423b01a9f9edea13dac90b9f23db434ac1d94d7f2159768b125c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1168A 17464 bytes
font_01_sfnt_off0001446a.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1446A 16792 bytes
font_02_sfnt_off00015c81.bin
dda34c9e3aa488b1fa88ccfd555c0b3972a76e3063ae22c51ba6a594cad82d5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15C81 10504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.