Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2585abe1a03245b…

MALICIOUS

PDF

75.0 KB Created: 2021-03-27 23:07:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bf575bc2c2757bd793b34cd6ee45977d SHA-1: f45330783cd19d58ed8f1e65b4338458592b3aa0 SHA-256: b2585abe1a03245badf4382ca4967f8717279ba38b2fc62dcd6e5b5ef7d00a71
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a 'fracture parents guide'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=fracture+parents+guide
    • http://nubolutlion.xyz/89260452883kxb0r.pdf
    • https://cdn-cms.f-static.net/uploads/4413462/normal_6014e514e2a2c.pdf
    • http://delaem-sami.online/bangla_adalat_movieie6ns.pdf
    • http://mihetos.xyz/bikojogozu1mto1.pdf
    • http://excellent-spb.ru/cyclops_odysseyyz7b9.pdf
    • https://cdn-cms.f-static.net/uploads/4393035/normal_605c584e3efda.pdf
    • https://cdn-cms.f-static.net/uploads/4378175/normal_60395e02d0068.pdf
    • http://shishkin-seed.xyz/nextbook_ares_11a_custom_romk5oao.pdf
    • http://appeal-ig.com/double_crochet_stitch_left_handedwxgbo.pdf
    • http://stavki-na-sport.site/8428854413555ywf.pdf
    • http://it50off.pro/spreadsheet_to_google_formkp6mx.pdf
    • http://milanbeach.fun/gajar_halwa_videoxkm9o.pdf
    • http://giftcard-sale.store/so_because_but_although_worksheetsij8a7.pdf
    • http://help-bluebadgecustomer.com/mezuzjpf4f.pdf
    • https://cdn-cms.f-static.net/uploads/4481402/normal_601b633e54336.pdf
    • http://sethel.xyz/6737020202206lup.pdf
    • http://mini-cam2.club/h8tqj.pdf
    • https://cdn-cms.f-static.net/uploads/4483103/normal_600ae7ce1757c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://44879a12-c10a-431c-a98a-7de142752d0f.filesusr.com/ugd/bb4607_49793509a04b413ba2d4523435dd6bdf.pdf?index=true
    • https://beca70af-11ea-46d2-a649-d7fd44c468ee.filesusr.com/ugd/dd41e2_694e68ce2c3242678053d3ab37a8d3a5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/95a14bed-96b7-4d45-a96d-8ce2530fe1ee/fiwigenuzugedodapixigalu.pdf
    • https://uploads.strikinglycdn.com/files/26e6419f-3151-45e6-87b4-08618365cf35/sivagobelixefo.pdf
    • https://uploads.strikinglycdn.com/files/2e45c0bc-2848-4274-a41e-c2eab05fc6b0/kobebedibe.pdf
    • https://uploads.strikinglycdn.com/files/5846a881-9a23-494d-9e01-d6a6e73c77a2/saxon_math_1_2.pdf
    • https://c064424b-11a8-4e39-a524-24a74bcd733d.filesusr.com/ugd/54e393_4cfd9123270a4dfa8b20bbc8660d5156.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e61d.bin
85c52fcca9e44fe5f1ae61b0e30d81a944b6dca8b8332ac52823a2b33eca1bf1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE61D 5164 bytes
font_01_sfnt_off0000f7b8.bin
66aed10bda520417b27373e8ee8a1b47bedb8acd8c3fecfda4665c60fee16479		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7B8 12020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.