Malicious PDF — malware analysis report

Static analysis result for SHA-256 acca6e3e1d756a64…

MALICIOUS

PDF

84.8 KB Created: 2021-07-21 17:45:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 3a96d927b068512e051a753c7b01ecbf SHA-1: 241d45c5a66b026a6a9dda7f3cf37395ea9b91fc SHA-256: acca6e3e1d756a6457cd1fcef480bb6bfe8f6309ad9239ce3a6bef3cd94dfe3d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a suspicious domain, which is likely used for phishing or to serve a secondary payload. The PDF structure and metadata suggest it is designed to appear as a legitimate document, such as a PowerPoint file, to trick users into visiting the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/square?utm_term=powerpoint+file+history
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e8532855c0ff04c7ff14e1/1625838376549/61755755100.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f3b27854c26a0cc3000b1b/1626583672307/71222445127.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f1c9b2024ace57e52c96b8/1626458546965/10010268815.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f820ce6b9c6a47815dbf49/1626874062876/wezetiz.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f736c99fae80636820bdf7/1626814153818/wide_dumbbell_press.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ecac4c05183b3b57a16509/1626123340066/remorolorufok.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e94e14320dbd0de2826550/1625902612981/43535458896.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f10cc8adf71e7547cc0c15/1626410184408/bixupijakem.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee263eeed6cd77ab60697c/1626220094570/princeton_cost_of_attendance.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edd9c62e8a4a2aca795401/1626200518802/2_colors_in_one_eye.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f08e17f6c6840c1d6a9963/1626377751120/rerosa.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee4cec1cf0e6777f2f7658/1626229996526/types_of_research_methods.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f42dbd9471b562af18e810/1626615229883/3072748198.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f74237d663d80ecbdcc43d/1626817079110/the_angle_of_elevation_of_a_jet_plane_from_a_point_p.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ee0c4377e2cd4113ec351e/1626213443160/29280962500.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e945ece51f1f218d6b2538/1625900525040/50520444329.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f7d7a13bf5736ec38a7545/1626855329695/can_i_transfer_money_from_my_cash_app_to_my_debit_card.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e7d34123621b4743e3c03a/1625805633579/condition_for_a_number_to_be_divisible_by_7.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f7ba34d401bc6ded29f636/1626847796439/nidikanitirujejabazida.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f2d0458c10a93e5046db5a/1626525766051/enable_commenting_on.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec7a1d5978cb5ccaa9d81b/1626110493728/94667981824.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea27.bin
4a0ea7e5fb642769a676f28ade57a78b476cd9dd32f9b1c65d2dec83ef25d4e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA27 10496 bytes
font_01_sfnt_off000101ff.bin
18ce22c296e2eab30f9967a8cf9b067bda1aed3f90a52184825d294bdd20913f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101FF 16592 bytes
font_02_sfnt_off00012ce5.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CE5 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.