Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac63d3fdded39967…

MALICIOUS

PDF

104.1 KB Created: 2021-03-16 13:18:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3afeb74cd06a9c902bd4fa83724f9857 SHA-1: 940fd77105f2c395149023dc9a26e67593588fa7 SHA-256: ac63d3fdded399676340b9ce8cfeb7779c572405d64b27f239f2466613df0f29
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL, https://maypoin.ru/wix?keyword=composite+figures+volume+5th+grade+worksheet, which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to educational worksheets, a common tactic for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=composite+figures+volume+5th+grade+worksheet
    • https://cdn.sqhk.co/pevizopubok/dEMTjiO/monkey_shoulder_batch_27_vs_original.pdf
    • http://tesekal.mygamesonline.org/zepis.pdf
    • https://static.s123-cdn-static.com/uploads/4379974/normal_5ff509056b0e7.pdf
    • https://static.s123-cdn-static.com/uploads/4422180/normal_5ffc8edd944b2.pdf
    • http://malespw.xyz/zilobigamumawanuxoperopwm9z.pdf
    • https://cdn.sqhk.co/gofuzurafano/JAsgigc/anime_fairy_girl_dress_up.pdf
    • https://cdn.sqhk.co/fuwasokeg/fghrxgi/25_free_printable_road_trip_games.pdf
    • http://jetinaxisodew.mypressonline.com/adjectif_de_couleur_accord.pdf
    • http://pipvip.ru/hp_6700_printer_driver9nus5.pdf
    • https://cdn-cms.f-static.net/uploads/4500668/normal_5fd3565946cf6.pdf
    • https://cdn.sqhk.co/ruwuwedelo/fiehcjg/ifetch_interactive_ball_launcher_for_dogs.pdf
    • http://kudikadip.getenjoyment.net/carsick_john_waters.pdf
    • http://indital.space/android_cardview_rounded_corners_image6j52x.pdf
    • http://zemesod.getenjoyment.net/86311118160.pdf
    • https://cdn.sqhk.co/resasenubori/P1ctjeo/world_war_z_season_2_roadmap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5eb4d4ca-269f-44f4-b41a-510b34ebf375/prince_lestat_books_by_anne_rice.pdf
    • https://uploads.strikinglycdn.com/files/8cb98b71-33eb-4f75-ab52-8a6bf86018ee/63951859032.pdf
    • https://uploads.strikinglycdn.com/files/366aadfc-d789-4015-893a-57328e40ebef/fidefuxipogafemapotiguw.pdf
    • https://uploads.strikinglycdn.com/files/78bfe043-aff0-4f29-99ba-4913abd0910d/bazuwofekaji.pdf
    • http://lusajafimaneru.myartsonline.com/simplification_of_algebraic_fractions.pdf
    • https://uploads.strikinglycdn.com/files/7931db27-ac3c-4654-9684-7c33890ac1e6/fiwevavigekule.pdf
    • https://uploads.strikinglycdn.com/files/dc40a3ae-f083-4e4f-bd2b-79c19983d19c/lateral_thinking_questions.pdf
    • https://uploads.strikinglycdn.com/files/38f530e2-5144-45c8-883f-e59569d806ad/37901531357.pdf
    • https://uploads.strikinglycdn.com/files/08da8f4c-20f5-4412-99cc-0cef209605d9/gevawatagorusisa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013f7c.bin
bf39e86c4c7abd15d1e7e22d49bd1cff8586075eefc9298528ef1a72cf04b9dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F7C 5700 bytes
font_01_sfnt_off000152c6.bin
d15ddab6df52f928395e9d4aa1864aa2065d1ac9280d715b20975d2eba75f153		 pdf-font-stream PDF embedded font (sfnt) at offset 0x152C6 12452 bytes
font_02_sfnt_off00017cf9.bin
f4df5f66f02f216fdd2fdcfeac783527d4fbd706c8bffd7f260a8f2b905018ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17CF9 16120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.