Malicious PDF — malware analysis report

Static analysis result for SHA-256 b25958df4bdbddb5…

MALICIOUS

PDF

652.2 KB Created: 2021-03-25 18:05:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: cfd3b1da25d2627baff86314fd52401d SHA-1: f3945daae2bf1b1efb8d9853cc6d4f2bff9504bb SHA-256: b25958df4bdbddb509cf21172b2ffb0b0ec85cf1017e4cd596b5f23687ef5541
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is malicious and has been flagged by a machine learning classifier and ClamAV. It embeds an external URI pointing to a URL that appears to be a lure, likely intended to trick the user into downloading a further payload or visiting a phishing site. The document body, though heavily corrupted, contains text related to the embedded URL's keyword, suggesting a social engineering pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9777

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=experimenting+with+confederation+guided+reading+answers PDF link annotation
    • https://cdn.sqhk.co/pubodegosog/J9Nighg/mejanirudum.pdfIn PDF document text
    • https://cdn.sqhk.co/mifijizudi/jjUjjjc/77621181601.pdfIn PDF document text
    • http://the-job.ru/american_football_workouts_at-home_without_equipmenti2tlj.pdfIn PDF document text
    • http://gamedv.design/what_color_tube_for_cmp_blood_testc6p9c.pdfIn PDF document text
    • http://dulugidi.iblogger.org/75429642443.pdfIn PDF document text
    • https://cdn.sqhk.co/zidodovare/hRjc9ja/18870607248.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413975/normal_600c62970bbd0.pdfIn PDF document text
    • https://cdn.sqhk.co/kewudomavave/fdhegeI/ralib.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419211/normal_5fddbe01a562a.pdfIn PDF document text
    • https://cdn.sqhk.co/rekutadis/jdyidhe/gujoxevevi.pdfIn PDF document text
    • https://cdn.sqhk.co/zivupowixede/jgipWie/sivupabiko.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://susupufewowe.epizy.com/jigeki.pdfIn PDF document text
    • https://76bf09fe-c378-4d6f-baa9-beaf48595a8b.filesusr.com/ugd/61567a_5a3496c945794b9e8ed52c413a2511cf.pdf?index=trueIn PDF document text
    • https://e6b56e3c-1b88-4cfb-972d-ab1702b0a06e.filesusr.com/ugd/8c0e65_9ff95a16da574fd3a76441ea32ca8bff.pdf?index=trueIn PDF document text
    • https://ba789de2-c385-43ee-b32d-a34c698d1993.filesusr.com/ugd/b7082a_64fbca7801344e60ad3d08891e84404c.pdf?index=trueIn PDF document text
    • https://29aa9d28-cc9d-45fc-8d86-3718b5881c84.filesusr.com/ugd/74c34a_40288858b463458e8c6e82edca1f29b8.pdf?index=trueIn PDF document text
    • https://6f12065f-c45d-410c-b048-6ec23fb2b810.filesusr.com/ugd/02ccf7_452ade0c9d644545a2b241795010fbca.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0009e2cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9E2CB 5656 bytes
SHA-256: 67f87f294305d13578edad5e3b4947d5c22ad434725390368e0b75f562ce98d2
font_01_sfnt_off0009f5f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F5F3 11672 bytes
SHA-256: 93647aaaa3f11b6b33bbab4285a5f965d0a87a5864448b18c8bca3fe64b7568e

Open this report in the interactive analyzer, or submit your own file for analysis.