Malicious PDF — malware analysis report

Static analysis result for SHA-256 a995a20e8af775ca…

MALICIOUS

PDF

288.0 KB Created: 2021-03-18 08:02:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: a355009e7ab44fd5818ef8b43beaf9f1 SHA-1: 15748c4f1a334cdf80aa5d143ba8817d7e6b4d1e SHA-256: a995a20e8af775ca36357a84abf0407528df07c2619cc99a443ced3d813e7e18
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/wix?keyword=buku+taoisme+pdf PDF link annotation
    • http://jonipifenukiz.mygamesonline.org/factoring_quadratic_expressions.pdfIn PDF document text
    • http://nabavawuzafurur.mygamesonline.org/uk_driving_theory_test_book_in_urdu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6f672a44-e16c-4921-a0f1-e3781c0647c5.filesusr.com/ugd/bda22a_b02a4ee977c74ea5a25d130c7fe1d13f.pdf?index=trueIn PDF document text
    • https://8e0cabef-d481-4215-b437-8a5fc4e4723c.filesusr.com/ugd/f41140_924d6fc9e89346a2bd9c638356d966ab.pdf?index=trueIn PDF document text
    • https://69f1164a-dcd3-4310-9fb4-3b67f03bdbb0.filesusr.com/ugd/9d7282_3327351002f3422e8528f754ff64d47a.pdf?index=trueIn PDF document text
    • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_ac96bab4e5b645a7af89d4ebca41d858.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xetasif/angry_birds_coloring_pages.pdfIn PDF document text
    • https://s3.amazonaws.com/feborobegibew/671597345.pdfIn PDF document text
    • https://989eff4c-946f-4221-9817-1a8d60f2082d.filesusr.com/ugd/7edf14_bc976f1c6c754c299085b6f3f2b9abe1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nufidibodudulad/pipadesufakale.pdfIn PDF document text
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_ad2f5f4fde074df7b7ff9423bdd47220.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dumupa/46798730975.pdfIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/how_to_put_samsung_washer_into_diagnostic_mode.pdfIn PDF document text
    • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_392e30ebdcb44f36bb46a1c265cee29d.pdf?index=trueIn PDF document text
    • https://87164119-88a6-4d6d-a72f-b109cf2d88b9.filesusr.com/ugd/bd0a66_755ed15c21b34ee68defc4d65058947a.pdf?index=trueIn PDF document text
    • https://02bc4616-4eae-4b38-b2c9-0e654f754ee0.filesusr.com/ugd/069df5_e2be005dd70b44ca9088db219367451a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/student_loan_payoff_calculator_google_sheets.pdfIn PDF document text
    • https://s3.amazonaws.com/suximawo/buxevofikazifidam.pdfIn PDF document text
    • https://3c4962d9-41f7-4f14-8396-dad57cc8de20.filesusr.com/ugd/a2de88_c67193ba0fd64e2b91f32a77eea5f2d4.pdf?index=trueIn PDF document text
    • https://70848fb0-0fd0-490a-9360-2ffa38fc212c.filesusr.com/ugd/08e331_10c7d7700f284f34aaf21823ef0d2d92.pdf?index=trueIn PDF document text
    • https://d56a38bf-d62e-453c-9b5b-5b2fe88aea46.filesusr.com/ugd/359e64_61f6b40159f2415b865739d5a07bb814.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lezerawe/chemistry_past_papers_o_level_gce_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000432da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x432DA 5172 bytes
SHA-256: 125f682e0372ae9bbc9480568f09d5b135472bceb475bc46eb14ae808bd34b4b
font_01_sfnt_off00044470.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44470 12448 bytes
SHA-256: c1254be2d839783a578c703623291db16fc905c0993838bb7ec46a11efe5e551

Open this report in the interactive analyzer, or submit your own file for analysis.