Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae5014454c4b9bc2…

MALICIOUS

PDF

100.1 KB Created: 2021-03-18 03:30:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 66bb8ba8fd72a6a971846523a70353b1 SHA-1: e8eda185cf0b9c8a3112981ef411c36f5ec7b2fd SHA-256: ae5014454c4b9bc2ae04ed1ab832c54239a5fee226a377c363b5d3e2e1ee53a3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, as malicious. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or social engineering scheme. The document body, though partially corrupted, suggests a lure related to 'school of dragons membership codes 2020', aiming to trick users into visiting the external URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=school+of+dragons+membership+codes+2020 PDF link annotation
    • http://ueuniti.xyz/35279112721ieeps.pdfIn PDF document text
    • http://help-lnstagram-verifycopyrgiht.com/42823356233qld0p.pdfIn PDF document text
    • http://perfectiona.online/minecraft_unblocked_sweet_and_awesome_jarr02qz.pdfIn PDF document text
    • http://gufutaca3.xyz/how_to_calculate_interest_on_my_line_of_creditaj30p.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455198/normal_5fe0db75292f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366358/normal_604e32c1533c9.pdfIn PDF document text
    • http://tidivon.iblogger.org/is_fried_green_tomatoes_about_cannibalism.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486534/normal_602a215d3f8f0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://jipawivenuzinu.rf.gd/first_five_year_plan_of_bhutan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce472099-e2cf-46bb-a459-33690206ad42/janupurapiraduvalexiladak.pdfIn PDF document text
    • https://s3.amazonaws.com/kujesulad/caliathletics_program.pdfIn PDF document text
    • http://tazefuwavubu.rf.gd/cisco_anyconnect_3._1_windows_8.pdfIn PDF document text
    • https://s3.amazonaws.com/wizitifowubux/football_referee_report_sample.pdfIn PDF document text
    • https://s3.amazonaws.com/wukara/81345670748.pdfIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/basic_english_usage_swan.pdfIn PDF document text
    • https://s3.amazonaws.com/xujitezu/kaxad.pdfIn PDF document text
    • https://s3.amazonaws.com/babuxufarizuxur/1174559356.pdfIn PDF document text
    • http://fazafowunop.epizy.com/inflected_endings_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/megodipewukitoj/gasuvigojosagububukik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2b3ef7a-1e7c-42cb-9c7f-595dcb7c266b/how_to_connect_msrm_wifi_extender.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010669.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10669 5792 bytes
SHA-256: 5f0587565411cfa99e3bbdf0c9b8f2cd2122cee1c501017c6429a07fc62b6d96
font_01_sfnt_off000119c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119C8 8060 bytes
SHA-256: 23db03096afe56fcc4c3db63172757d71f735c591e84c9406eee1c234f1ec223
font_02_sfnt_off00013511.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13511 11616 bytes
SHA-256: f93123578fee3a252b91ef792e9ef4234932e4801a42abb1464ed618fbbaf038
font_03_sfnt_off00015ca9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15CA9 16536 bytes
SHA-256: 742185543429f98e823de74f7aa1276e398d215e8594bd10b97d72a801f12f77
font_04_sfnt_off0001734c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1734C 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.