Malicious PDF — malware analysis report

Static analysis result for SHA-256 abddf3be21f0682f…

MALICIOUS

PDF

77.5 KB Created: 2021-04-27 04:10:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4ba80acb4e1ef93927a43dfc686dad23 SHA-1: e33a29969ac57ee5188c7f4970ddcbef5ba35a1d SHA-256: abddf3be21f0682f095b8a419eee1df4096be0250f268ccd5abeeeb1dd4ef356
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to 'book report rubric grade 4'. No scripts were extracted, but the presence of an external URI and high risk score suggest a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=book+report+rubric+grade+4
    • https://wabumixa.weebly.com/uploads/1/3/4/5/134585451/8a5c73c1f47.pdf
    • https://cdn.sqhk.co/dupeguwova/ifHkvPp/ninjas_infinity_2_mod_apk.pdf
    • http://jebumivusesujan.iblogger.org/zixesakivarite.pdf
    • https://xukutejupu.weebly.com/uploads/1/3/4/4/134487517/a09b9077.pdf
    • http://naturebiolog.space/lutodupize4guxx.pdf
    • http://zazafuzavap.22web.org/92019165871.pdf
    • https://cdn.sqhk.co/xedufoga/jH0piht/real_home_theatre_systems.pdf
    • https://tifalexax.weebly.com/uploads/1/3/4/4/134471923/6b22ef71.pdf
    • http://auth02mobility.com/dream_league_soccer_2021_appolgoa.pdf
    • https://nametipij.weebly.com/uploads/1/3/1/1/131164318/gudof.pdf
    • http://operationhomeplate.com/karakomonirifuduguwoxzsb.pdf
    • https://cdn.sqhk.co/tiwumixe/Q40gehi/best_heart_rate_monitor_for_peloton.pdf
    • http://reawont.online/342573483394pnfb.pdf
    • http://new-volosi.ru/the_power_of_love_movie_2020z99ec.pdf
    • http://fodamibokaf.66ghz.com/insert_calendar_in_excel_2010_spreadsheet.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jidosatikim/vuruzugetujixezugivodux.pdf
    • http://kesofater.rf.gd/que_significa_artesanal_wikipedia.pdf
    • https://s3.amazonaws.com/mipizaju/liribidixibudutibaruxud.pdf
    • https://cc603790-e41b-456e-9848-d053b607cad6.filesusr.com/ugd/389793_871631be48324d75b1784eecb1636758.pdf?index=true
    • https://s3.amazonaws.com/rafiralexezol/hotstar_premium_account_cookies.pdf
    • http://mevexunimapo.epizy.com/kung_fu_hustle_2_full_movie_watch_online_free.pdf
    • https://3682d434-6e27-4ac8-9ac2-d3ec24fa429c.filesusr.com/ugd/9b5f63_0ce5728bc2264f7ebca32419d8310c7d.pdf?index=true
    • https://s3.amazonaws.com/vetamedisoz/6200408798.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef49.bin
2fae47674fcfb339b8589b64130b2ebf4dc1bcdba928133d0d79d0d07490b15e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF49 5372 bytes
font_01_sfnt_off000101a2.bin
03e9929af2005aaf7612cd8b50901ce8ab735ca38a7232bc4a455124bf969d69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101A2 11520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.