Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2a36c5bad22bc2c…

MALICIOUS

PDF

84.7 KB Created: 2021-07-19 18:31:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 7cf94357d4998366b5d6f25a21b018ed SHA-1: ecf4bf3e21382594016b3cf8a860752746ee838f SHA-256: b2a36c5bad22bc2c80c40c5bfa5f32865d44fa762c88256230ff892b0d1028c3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan. The ML classifier also indicated a high probability of maliciousness. While the document body is heavily obfuscated and unreadable, the presence of an embedded URI pointing to what appears to be educational content, combined with the ClamAV detection, suggests a phishing or social engineering attempt to trick the user into visiting a malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6233

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/X6hrLWyzjlw/square?utm_term=matrices+class+11+solutions+pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e78d3c1c6ee137fa0c2786/1625787708623/3011740775.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e942eb8ce0e10532d3b670/1625899755082/basic_of_financial_accounting.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee045aa9d1f62037e70366/1626211418176/vefosenotasejegagov.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60efd95c39c5d52effb501f5/1626331485077/nj_business_certificate_of_good_standing.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edb28a1a2ce466740dfc9a/1626190474390/the_meaning_of_statutory.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f428106f491d4a1ff94ef8/1626613776699/55432089331.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d01b.bin
ea200c67da6550b76232aa041951dbea7e2cb67825c0f8d3e39f019a200ac637		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD01B 18048 bytes
font_01_sfnt_off00010015.bin
450eea5fc67953cc3bdc764260aa6f1739571c17331c9588074966c3dbef4c6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10015 16088 bytes
font_02_sfnt_off0001154a.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1154A 16792 bytes
font_03_sfnt_off00012d61.bin
896b7e479ed36a5f458edd46c1b3866105539c9466f677e2a8c9c90c0feef18c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D61 10760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.