Malicious PDF — malware analysis report

Static analysis result for SHA-256 af3336f1c1f53267…

MALICIOUS

PDF

76.8 KB Created: 2021-03-24 15:28:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 180685d9ac4a348d4404220d066dce6f SHA-1: d35a89ef0d059b773fe8b19d6d4acea79d315ad6 SHA-256: af3336f1c1f5326785905dc43d0c11f97a4c217959c9f3261fd243bcc1b3843f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to educational materials, which is a common tactic for phishing and malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=jolly+phonics+tricky+words+flowers+pdf
    • http://physcoo.com/skull_wallpaper_for_android_mobilevbecs.pdf
    • https://roxasunuveju.weebly.com/uploads/1/3/1/4/131437516/999624.pdf
    • https://gevotasi.weebly.com/uploads/1/3/4/3/134389209/napotujemejize.pdf
    • http://premial.su/arduino_ide_windows_10_driverhu9hy.pdf
    • http://rasprodavaika.ru/yamaleela_2_audio_songs_ingowy0s.pdf
    • https://jadigitunuw.weebly.com/uploads/1/3/4/6/134672933/5039313.pdf
    • https://cdn.sqhk.co/polirorenu/ehhjagc/saturn_gutschein_online_einlosen.pdf
    • https://cdn.sqhk.co/zoluwumenad/RjhHii5/lijiwelusewe.pdf
    • http://grantmedica.ru/demon_slayer_rpg_2_breathing_levelnxngz.pdf
    • http://my-credit.info/57359886689namuu.pdf
    • https://zavitakeji.weebly.com/uploads/1/3/4/9/134904790/4939304.pdf
    • https://cdn.sqhk.co/dapubebireba/hdLz3RC/selozupunoluja.pdf
    • http://ellmax-site.xyz/15364709901ijbuf.pdf
    • https://cdn.sqhk.co/vefomatakin/ggDhjNG/37278840005.pdf
    • https://cdn.sqhk.co/penavagalo/hbejIp2/rope_swing_silver_games.pdf
    • https://wavafawiwex.weebly.com/uploads/1/3/2/8/132815000/diminunina-menulefuforoge-gowuzuvuxera.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/86f9a8df-cef2-40d8-9e0c-98b3a053ac81/58590908034.pdf
    • https://s3.amazonaws.com/luramamelolem/roles_responsibilities_matrix_template_excel.pdf
    • https://uploads.strikinglycdn.com/files/5e4f94c4-7cdf-4d28-be15-132c67295a27/53850453725.pdf
    • https://uploads.strikinglycdn.com/files/d6ba5d2f-5a02-43ca-b427-b8057230e068/data_structures_and_algorithms_in_python.pdf
    • https://uploads.strikinglycdn.com/files/dae8f3b4-906c-4dec-ae1b-7ef138cd0a45/dotuvafatigidawop.pdf
    • https://s3.amazonaws.com/kumasala/halving_worksheets_for_year_1.pdf
    • https://uploads.strikinglycdn.com/files/b25090cb-3851-400e-9b40-cdffad98e58a/68287707753.pdf
    • https://s3.amazonaws.com/zatasipezeg/annamalai_tamil_movie_bgm.pdf
    • https://s3.amazonaws.com/gateme/how_to_interpret_data_in_science_interview.pdf
    • https://s3.amazonaws.com/jitimesolagun/caderno_quadriculado_japones.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed7b.bin
34190273828d8239e1b503b5f85d7b020095d705a700488c3a0abaa68a42d1d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED7B 5280 bytes
font_01_sfnt_off0000ff86.bin
8943b2130e816877614e7d151fef9b6c8b5564627e831ec6e02a66faa9fefa77		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF86 10848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.