Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab7f88e0c683fe58…

MALICIOUS

PDF

89.6 KB Created: 2021-07-17 14:39:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 170b0ff7fbbb6172531e1a73c03e59d0 SHA-1: c85ec3682618de8aca59fe7fa789a32806ed84d1 SHA-256: ab7f88e0c683fe588bcc1351f3942f6f6de19252c717fff24ddb8a3ff1e6e662
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by ClamAV as malicious and a machine learning classifier also indicated a high probability of maliciousness. An embedded URI points to a URL that appears to be part of a phishing lure, likely intended to trick users into visiting a compromised or malicious site. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5134

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/gOBB6uaVNRA/square?utm_term=ffbe+war+of+the+visions+global+mod+apk
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f148582606b657d3585ab3/1626425432606/song_of_storms_ocarina_12_hole.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f172c2b238236d2335fd75/1626436290950/kexebirelizasami.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f1f84a18cf4731343d8607/1626470474335/pejov.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e87006131e486bf96237f5/1625845766292/30034678888.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60eddf33e11d817478d1edcd/1626201907780/zozuwepora.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f16e935142327a87449628/1626435219373/living_with_a_psychotic_person.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee5bc7796bb0196c63b6cf/1626233799254/the_hive_all_star_cheer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7ae.bin
a1c4c9e1fdc903fa5eae7e2654b05297d90ecc107071952d1553050eb82f386a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7AE 16724 bytes
font_01_sfnt_off000102f9.bin
a40e6855181a31c594db33e19fb9912ebeb02d8883aecbbce3178f672802eee7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102F9 11308 bytes
font_02_sfnt_off00011cf9.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CF9 16792 bytes
font_03_sfnt_off0001350a.bin
6c7e1b754cf38ee70ad76cb780c90d71dc4ff6fc3e14eab78a91c98fc4406452		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1350A 16248 bytes
font_04_sfnt_off00014ad1.bin
0d8c66d39bd235ec45555d6784fa1758d19951c735e6ccb1500bd5fee86c82ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14AD1 3164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.