Malicious PDF — malware analysis report

Static analysis result for SHA-256 abae3ff9a26901a8…

MALICIOUS

PDF

84.3 KB Created: 2021-03-21 20:54:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 393518b266f4f1dc88f4901425353051 SHA-1: 0126129f2826d68a870f2a4dcd07dcf434a15f34 SHA-256: abae3ff9a26901a8af9bccc4a43f97f0e4da663de5a2f8d6720c4f78850bdcb4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an embedded external URI and is flagged by a machine learning classifier and ClamAV as malicious. The document body, though heavily obfuscated, suggests a lure related to 'how to use ipads in the classroom'. The primary IOC is the malicious URL embedded within the document, which likely leads to a phishing or malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=how+to+use+ipads+in+the+classroom
    • https://cdn.sqhk.co/pijovowifil/OTgdhar/ximojuwenamularobapupop.pdf
    • http://piwofoterif.sportsontheweb.net/how_to_use_resistance_bands_for_legs_and_glutes.pdf
    • https://cdn.sqhk.co/xobevopu/ifHpCij/5197451038.pdf
    • https://cdn.sqhk.co/wodelaganav/tgju9ja/child_proof_cell_phone_case.pdf
    • https://cdn.sqhk.co/zafilivopupu/3xibghJ/free_printable_conversational_english_worksheets.pdf
    • https://cdn.sqhk.co/zonigita/jbijgee/asma_intermiten_adalah.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/17ce67c3-1589-4bf5-b43f-ab7a176eaf52/paladin_subclasses_5e_homebrew.pdf
    • https://uploads.strikinglycdn.com/files/cb248efb-a591-4760-a722-28971c27fff6/popezuribunedamizu.pdf
    • https://s3.amazonaws.com/megulu/medicare_ambulatory_surgery_center_guidelines.pdf
    • https://s3.amazonaws.com/wefadep/debussy_arabesque_free_sheet_music.pdf
    • https://s3.amazonaws.com/sitozi/smuckers_jam_nutrition_information.pdf
    • https://s3.amazonaws.com/wofaxil/what_is_the_micron_rating_of_n95.pdf
    • https://uploads.strikinglycdn.com/files/693044c3-35d1-4b26-ad5f-e3caa2146472/used_icom_718_for_sale.pdf
    • http://pekiluji.atwebpages.com/72751479514.pdf
    • https://s3.amazonaws.com/daraniwekamidir/dsc_pk5501_manual_espaol.pdf
    • https://s3.amazonaws.com/wifukedot/singer_201-2_bobbin.pdf
    • https://s3.amazonaws.com/voxazedisula/16295707227.pdf
    • https://s3.amazonaws.com/nemafu/spanish_subject_pronouns_worksheet_answer_key.pdf
    • https://s3.amazonaws.com/genukopapovixo/semadibatoninavudopogapim.pdf
    • https://s3.amazonaws.com/wifukedot/37693808340.pdf
    • https://s3.amazonaws.com/jazamerijekufol/father_s_day_worksheets_activities.pdf
    • https://s3.amazonaws.com/sowirutelevolur/zitagonejoronofonopew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ae0.bin
340643f1f036b3020e46756144fb100c4483bd8618bda6c35908d079efaf32c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AE0 5368 bytes
font_01_sfnt_off00011cfd.bin
1bc41c48148513e3e3125e0653ce4a1b1ca9a13d31303b96fab0a2aba154ef03		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CFD 11460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.