Malicious PDF — malware analysis report

Static analysis result for SHA-256 adda47e736ccbf2f…

MALICIOUS

PDF

82.6 KB Created: 2021-07-14 00:56:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 64a10a7e3dafdb1dda758a2db3b42a54 SHA-1: 3b3e38529f03e223d06b1b9cace3ec5d778dd31a SHA-256: adda47e736ccbf2f69174ab84baa4311dd5fcdd3e47f35d7603d903e9e6b500e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an embedded URL, although currently flagged as benign, suggests a potential vector for further compromise. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall structure and heuristic firings point towards a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/-7-cX3opz_8/square?utm_term=growing+african+violets+from+leaves
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee07f7fc191471fc684770/1626212343356/47059375649.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e92ea4b673687559683d9b/1625894565101/first_grade_review_worksheets.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee07b84c056a31b81f9c02/1626212280240/how_to_find_the_y_intercept_of_a_straight_line.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee07c71c6c1a61d5297642/1626212295924/89733642096.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e9543092abcc18c4f7a3a7/1625904176876/tortle_barbarian_5e.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec838e4a8bde38c344dfdc/1626112910428/zuruwon.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec882ea1f8f93f64ac3f8c/1626114094181/daren.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee049f537dfa200408ae74/1626211487807/artificial_flavors_made_from_beaver.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e8c51cd7702a4b9a6f592a/1625867548135/jipuxunukupakomen.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee013e670c344ea760acb9/1626210622574/things_acupuncture_can_treat.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edf9a1bf52576c624a1694/1626208673979/33557266089.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60edac083d37cd087e6de3f6/1626188808738/in_my_hour_of_darkness_lyrics_meaning.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee08937dee9f188f743e17/1626212499696/patient_confidentiality_meaning.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e9580de51f1f218d6b932e/1625905165129/95352259908.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df9f.bin
6439e184a716c3df91f6aa48b7ebc7a6eefb444150783d9e6b1b8b59de9ca968		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF9F 17084 bytes
font_01_sfnt_off00010c75.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C75 16792 bytes
font_02_sfnt_off0001248c.bin
538b5052a248f9f4156ad7b353b8bec53bb73f1ff306a175a35e4970b7f7c455		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1248C 10872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.