Malicious PDF — malware analysis report

Static analysis result for SHA-256 aea093ab7ecf8a65…

MALICIOUS

PDF

66.0 KB Created: 2021-03-11 09:30:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: c79529e830752c09570debe2a7da4daa SHA-1: 2128da23e6bb7b199a19edf158865dcf21e552a8 SHA-256: aea093ab7ecf8a6551568aa87a541e2f7948069ba0cf893646f81d1ab398e739
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=printable+worksheet+adding+and+subtracting+integers PDF link annotation
    • http://gooddevice-online.com/gepos5xprz.pdfIn PDF document text
    • http://kogutipabu.22web.org/givevonudugu.pdfIn PDF document text
    • http://betmoy57.com/vudakotamusifisunuluworus6x0h2.pdfIn PDF document text
    • http://xoxinusenavi.66ghz.com/bifuxut.pdfIn PDF document text
    • https://cdn.sqhk.co/leredupodeka/gcaNjfB/vijolipaja.pdfIn PDF document text
    • http://nefupanono.mygamesonline.org/medea_euripides_gredos.pdfIn PDF document text
    • https://cdn.sqhk.co/viforoge/ejdjjjb/70595782148.pdfIn PDF document text
    • http://kojazunupetip.mygamesonline.org/modle_cahier_journal_vierge.pdfIn PDF document text
    • http://russianstravel.ru/6475173405jjbny.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bidanata.rf.gd/weekly_schedule_fillable.pdfIn PDF document text
    • https://s3.amazonaws.com/nitidadufetenu/sample_application_form_for_australian_passport.pdfIn PDF document text
    • http://xawezukazekexi.epizy.com/cet_admit_card_2019_link.pdfIn PDF document text
    • https://s3.amazonaws.com/lekelepowo/ralph_ellison_invisible_man_summary.pdfIn PDF document text
    • https://s3.amazonaws.com/vonuxagupeduze/polobanib.pdfIn PDF document text
    • https://s3.amazonaws.com/xaliwalufoguni/migugebinevagijavepomu.pdfIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/internet_advertising_advantages.pdfIn PDF document text
    • https://s3.amazonaws.com/zagubip/9621276835.pdfIn PDF document text
    • https://s3.amazonaws.com/mivokozibu/6988332123.pdfIn PDF document text
    • http://wubulinefoz.rf.gd/dabukikobedobosu.pdfIn PDF document text
    • https://s3.amazonaws.com/dukavunivifa/precalculus_online_textbook.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c6e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC6E2 5496 bytes
SHA-256: 655de2e9ce2df9ba7c3c4c7560ab9b8af01090aca3ed8ebd78fa45a0e9811713
font_01_sfnt_off0000d99a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD99A 9400 bytes
SHA-256: 9a99b45672479117cb3ead1d25e459133d90d878d2bebe6d70a02fd239ef4565

Open this report in the interactive analyzer, or submit your own file for analysis.