Malicious PDF — malware analysis report

Static analysis result for SHA-256 a750f5fc8578e2b3…

MALICIOUS

PDF

79.0 KB Created: 2021-03-20 23:57:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f43278c355a06c9313aa58fac0333ade SHA-1: 7e3bfca477aa0965a7b5b9d1a5cd01a3555b552e SHA-256: a750f5fc8578e2b3a6609854d703c5c806c63ce71d50ac1da433515a78827963
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by ML classifiers and ClamAV as malicious. Heuristics indicate it contains an external URI pointing to a suspicious domain, and the document body, though partially corrupted, suggests a lure related to "lesson answers" combined with advance-fee scam language. This combination strongly indicates a phishing or scam attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=lesson+17-1+understanding+ratios+answers
    • http://neip-forum.fun/how_to_be_a_gentleman_book_brooks_brothers8bapq.pdf
    • http://sis-paypal.com/how_to_set_up_holmes_air_purifiermyc8m.pdf
    • http://frut-tree.site/wiwuxusotobigotogabokugozk76zu.pdf
    • http://copyrighthelpptteam.com/51743534588rrrw0.pdf
    • http://hydrofthol.space/13029100382jfly4.pdf
    • http://vogolimipogusoz.mypressonline.com/define_classical_conditioning_theory.pdf
    • http://fuwijumazawad.mywebcommunity.org/strategic_thinking_and_business_planning.pdf
    • http://dvigatel.guru/savage_tide_adventure_pathmuac5.pdf
    • http://weinmvc.net/6604787466f6m9l.pdf
    • http://vittorguxx.site/xipesufizoretinofedajadevujqku.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_cc13402cb03742158175350f79ff0587.pdf?index=true
    • https://e22e8d81-f41f-4d51-abb1-39b19d2d32bb.filesusr.com/ugd/96bf9d_5aec330913f94b9fa471ab5e0bbc0d66.pdf?index=true
    • https://s3.amazonaws.com/feborobegibew/english_to_assamese_offline_dictionary.pdf
    • http://wenulusevikofa.myartsonline.com/55057398074.pdf
    • https://s3.amazonaws.com/lovetijif/mosibudobudemudo.pdf
    • https://0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com/ugd/e6092c_b51763e1a96542bcbf0d6eefaaa3daa7.pdf?index=true
    • https://1261df91-4e32-40b2-8b8a-4050d3c54cbb.filesusr.com/ugd/df69c1_6b26179e041b47f8b3a026f61d988d2c.pdf?index=true
    • https://ff536187-e25a-4bd2-965b-ff1113cf40b0.filesusr.com/ugd/bfcccc_92845c68c1f146128e944a1dfd5db257.pdf?index=true
    • https://s3.amazonaws.com/midaguvimabof/80782413284.pdf
    • https://f3dbd103-cf2f-44fc-b0ad-c9004dc38af2.filesusr.com/ugd/1f2646_18aa4a98e88e42bca0dc869ea3119495.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6f7.bin
5eb8ca9fc764ad8724faef71c0379dd18c2f27e0bbb8b0344aa8a9dd57a92512		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6F7 5156 bytes
font_01_sfnt_off000108b1.bin
64d0060e862c478da7724fb769766c96a7f085ba6f1ab693bffb3f112e88357c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108B1 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.