Malicious PDF — malware analysis report

Static analysis result for SHA-256 a676ad2518d512b0…

MALICIOUS

PDF

84.1 KB Created: 2021-07-22 00:52:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: b56b51a0ddc6662fab5ac6f22e4299de SHA-1: 9d63c3252d9d46153d121f6a5ca1b548b5e8b698 SHA-256: a676ad2518d512b0b21689cb730061ef5d7b243a7bd5065fd897d915f4e67a52
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The ML classifier and ClamAV detection strongly indicate this PDF is malicious. The presence of embedded URLs, despite some being marked as benign, suggests a potential phishing or malware distribution vector. The file's structure and heuristic firings point towards exploitation of PDF vulnerabilities to execute malicious code.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/IdU8rIDf9lQ/square?utm_term=another+word+for+it+says
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee78a7b27e5958d592b500/1626241191384/dostoevsky_a_writer_in_his_time.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ed9ec8b2cb0e528689f982/1626185417057/gawivajikefefo.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e7e78681471576eaed7251/1625810823289/kulefoxiguwagedolapivina.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f492e0ce637c2583478c87/1626641121100/the_lion_sleeps_tonight_keyboard_notes.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f5e22c2adb9e0374a6c17d/1626726956610/bajaw.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f89291ca0172497305fadf/1626903185755/kebojotewutujegi.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e7ff03e8ef4d41b4fc3177/1625816835223/88833439200.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f2ffa6b84a576e6cfc07ad/1626537894594/55418859132.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e78d037d3b385c94b138da/1625787651353/who_manual_for_sperm_analysis_2010.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8c1482aed951818547363/1625866568477/pdf_to_excel_ocr_free_online.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8bf26c0e666153b741ab8/1625866022299/44880241037.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f0c778e7c782239583437f/1626392441136/22138875073.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ee7789462f394a1e45999b/1626240905202/fininogedosavolun.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f8515f30e28e26df808d42/1626886495309/zelajodaxe.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f17c804bb49071de1d1a15/1626438785089/89157234211.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f89133aa32ea2fffafe86e/1626902835210/average_distance_for_60_degree_wedge.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e851afd810225d8c7cd9b1/1625837999494/ruptured_pectoral_muscle.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f22921db752c5e499fb702/1626482977795/lurevadelewago.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8b49b1b38cc0852605aa3/1625863323691/fovebovumeletonu.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f1f411c7f9ba204f8297a2/1626469393815/cbt_for_intrusive_thoughts.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e69a.bin
7131ecf51f91243cc7f690cee153229d8f2a6e1c9b8347d4e22396dd2098b4cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE69A 10588 bytes
font_01_sfnt_off0000fedb.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEDB 16792 bytes
font_02_sfnt_off000116ed.bin
151db44d66c281674610b58d4eace5729856db23466f3e4d568bd2d18e6dc3bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116ED 16844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.