Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0f6b85193be077c…

MALICIOUS

PDF

90.6 KB Created: 2021-03-21 21:32:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0934d0b662b406b1236f556688c5d31e SHA-1: 764678b7122a9d7eda23e6dcbbb34372734dd68f SHA-256: b0f6b85193be077c2949ef80f5103a50d1ffa5caaaa5745914488b4bfe5f5a7c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, and it contains an embedded URL pointing to a suspicious domain. The document body, though heavily obfuscated, suggests a lure related to educational worksheets. The presence of an external URI indicates an attempt to redirect the user to a malicious site, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=perimeter+area+and+scale+factor+worksheet+answers
    • https://cdn.sqhk.co/pozazoji/iigjjfN/versatile_worker_in_a_sentence.pdf
    • https://cdn-cms.f-static.net/uploads/4412568/normal_602071e05ed8f.pdf
    • https://cdn-cms.f-static.net/uploads/4467573/normal_601e63f6ca87b.pdf
    • https://cdn-cms.f-static.net/uploads/4485823/normal_60199d669b3bb.pdf
    • https://cdn-cms.f-static.net/uploads/4472793/normal_600c51dc3d39f.pdf
    • https://cdn.sqhk.co/ninulekuto/gjiggc6/sas_urban_survival_handbook_free_download.pdf
    • https://cdn.sqhk.co/desiruzag/gfdifig/togagukoxejisakexejog.pdf
    • https://cdn.sqhk.co/pugudanirav/eI1gjgu/meteor_shower_acnh_times.pdf
    • https://cdn.sqhk.co/businaxidare/aA9hdTL/archero_rune_unlock.pdf
    • https://cdn.sqhk.co/peluxisomex/kjcFsjc/lusejidijetub.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0046a727-df8f-4da2-9244-bd689549f739/fiwukegikiwibugaxoneted.pdf
    • https://uploads.strikinglycdn.com/files/63c214c3-3811-47bf-b515-5a41213db215/2006_porsche_911_maintenance_costs.pdf
    • https://2d2b1dae-c014-4902-97e6-c3f1d56915cd.filesusr.com/ugd/70e5f7_4cbf2218ffbe47f9b53fa7ce38a9dce5.pdf?index=true
    • https://26bfc7ce-baa4-43a1-9280-72312523cbd3.filesusr.com/ugd/5af86b_41e283c0c955425c8e9e89b8b7ce99e6.pdf?index=true
    • https://s3.amazonaws.com/bugutaj/world_geography_map_skills_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/ef8f7eb6-d356-41e1-a479-41455d793f9c/possessive_adjectives_multiple_choice_test.pdf
    • https://73f4d879-981c-49fe-abc7-520f36a14a84.filesusr.com/ugd/b77b08_9fc1fe39b704495a84808ea9fa3c6285.pdf?index=true
    • https://s3.amazonaws.com/rimejiguvif/evga_1070_sc_overclock_guide.pdf
    • https://fc06435f-e709-4c80-b59d-96fa470c1a13.filesusr.com/ugd/bdc04d_989a6a6a3a4a49eca1453adb09bc142c.pdf?index=true
    • https://s3.amazonaws.com/jedobufudajewu/free_annual_credit_report_gov.pdf
    • https://s3.amazonaws.com/remavuj/22684251771.pdf
    • https://uploads.strikinglycdn.com/files/ab01ae49-39a5-4d07-824c-e1329834861b/samsung_refrigerator_model_rfg298hdrs_xaa_manual.pdf
    • https://uploads.strikinglycdn.com/files/2b34bf77-5d26-48ee-b9e2-86f2fbea8c60/zigadagotimanuxolipunagil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f0e.bin
61c63dfda54783aa0014dea9ba2827811e7fc701df559ff72163fb3cd82b8f09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F0E 5416 bytes
font_01_sfnt_off00012163.bin
3d790cf467724ca2e5dfcbc43390c4fdb2b0fa2d7f0572d123128f063f7647cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12163 11004 bytes
font_02_sfnt_off0001471f.bin
39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1471F 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.