Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae21f2ce9017282e…

MALICIOUS

PDF

82.5 KB Created: 2021-07-22 13:47:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 520fa0d02dcf9f811b0806d1a68c9119 SHA-1: edeb6c6a076bfd4ade91918caf6328711c0aab04 SHA-256: ae21f2ce9017282ed5aa080ae52b35cb49482f50da86d3d93a6bbd83fb6183d6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The presence of embedded URLs suggests an attempt to redirect the user to a malicious site or download a secondary payload. The file's structure and heuristic firings indicate it is designed to exploit vulnerabilities within PDF readers.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/AnJPYMJXbyQ/square?utm_term=cp+in+babies
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f7a76924e1ff4810442160/1626842986106/the_drumset_musician_download.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f1d34b2536e243c9eabb00/1626461003207/the_uncertainty_involved_in_the_measurement.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f6823749ed543a17dc576f/1626767927319/noxek.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f81a033fe7684a17bed04c/1626872323447/53251212920.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f449a9a8f65e35b6e28900/1626622377333/29966303972.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8c77509230f0e18425ff7/1625868149872/telolinazuwobasubob.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f2141fc5d9e6782cd43281/1626477599846/career_chart_after_12th_science.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f4845436db646251ac684e/1626637396588/kevudazelakazudowikibu.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f37030ec5ad00cc091acad/1626566704796/zinema.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f52bda1db272198fad2a8b/1626680282613/introduction_to_coastal_engineering_and_management_kamphuis.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f4871f8a396f1703aba8f9/1626638111262/92964308782.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f3070926c2747482dbaefb/1626539785610/sabigutuxe.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f627b2b39ca66bf8cd8129/1626744754598/59667022189.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f02d56bba06d2f341ad7ce/1626352982957/another_word_for_clear_vision.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f1c67ff543673d341498d0/1626457727973/59754297314.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e7dbff81ab8d1aa9df058a/1625807871496/66864312573.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec8c72af807f1e15260750/1626115186270/dinozep.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f865ce1f43fe4b0e0edf14/1626891726292/framaroot_apk_download_for_android.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e773757707ed416df50a69/1625781109891/61278207888.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ee32eafb3cc800db54b55b/1626223338466/owners_manual_kenmore_washer.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ed97decd0cb17c762e3aa7/1626183647195/aphids_on_plant_leaves.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3bb.bin
b85b719cc598d69b75196e87a5595bcf9b533b5ca9ffca7fac656da80b7d7045		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3BB 16456 bytes
font_01_sfnt_off00010e86.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E86 16792 bytes
font_02_sfnt_off0001269d.bin
5414d7bcedd64ca0a0696d725d789935cdf56ec8072c1f16ff8661b9a674da13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1269D 10052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.