Malicious PDF — malware analysis report

Static analysis result for SHA-256 b53ee4e4f691b999…

MALICIOUS

PDF

80.2 KB Created: 2021-03-19 11:06:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 66865a0234d0ced70cc224b6d0a98948 SHA-1: 79494693ff32a2ef02d9232c47d6c588bfbd21c7 SHA-256: b53ee4e4f691b999404855ca0af6577e54aa955ce24ea3bf188c8f55f4b99e74
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that mimics a search result for a textbook, likely intended to trick the user into downloading further malicious content. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of its specific payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=genki+1+second+edition+textbook+pdf+download
    • http://wofaguwere.iblogger.org/alcort_minifish_owners_manual.pdf
    • https://cdn.sqhk.co/goropakuvoge/tgcNeLv/asap_rocky_babushka_boi_mp4.pdf
    • http://nigoguno.scienceontheweb.net/biology_lab_report_format_example.pdf
    • http://zenaxudoriw.mypressonline.com/83261388402.pdf
    • http://jabudapitu.scienceontheweb.net/31935423772.pdf
    • http://xugerovogubex.22web.org/35797965964.pdf
    • http://netolenogafa.getenjoyment.net/the_haunting_of_hill_house_free.pdf
    • https://cdn.sqhk.co/malasexek/adjeiaX/black_friday_deals_apple_store_2019.pdf
    • https://cdn.sqhk.co/jesovolavig/jgiepgc/66054471787.pdf
    • http://bajelow.iblogger.org/dometic_ac_thermostat_programming.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://mitikujedusor.epizy.com/94072320897.pdf
    • https://s3.amazonaws.com/liwafo/21877816534.pdf
    • https://s3.amazonaws.com/tumasun/arya_2_movie_hd_images.pdf
    • https://f815f12b-539f-4060-8ed9-abd2caada31b.filesusr.com/ugd/ceb2e8_e69d234f1915460c938fd27d243f9d84.pdf?index=true
    • http://zusagijumetuze.epizy.com/jorijodiluponasixapedake.pdf
    • https://s3.amazonaws.com/jeworurowam/13528295077.pdf
    • https://s3.amazonaws.com/remufuzu/13451202218.pdf
    • https://9170d309-caca-4186-8987-bf6b40ce219c.filesusr.com/ugd/baef12_3bb36790b7d44144ab09af5aa8579090.pdf?index=true
    • http://lanobifojedepa.epizy.com/fuzzy_mathematical_programming.pdf
    • http://bojonovaja.rf.gd/zajiwulupiwolunexil.pdf
    • http://tokuloxigov.epizy.com/voodoo_labs_pedal_power_2_vs_plus.pdf
    • https://d3826037-6016-486c-99e9-dc41bc666644.filesusr.com/ugd/b81754_404efd52449349a98cd8973dfe209e5d.pdf?index=true
    • https://89511c73-251b-4bee-a1a5-5f4bd4863124.filesusr.com/ugd/f24cb8_fb3aa699991249ed94e23b47c7afc638.pdf?index=true
    • https://s3.amazonaws.com/dopugaxelelema/2838053306.pdf
    • https://43dda2ad-fadc-418c-a2d5-4b96cca2ed60.filesusr.com/ugd/6eca9c_7564f5095a164a76af50521091d9f814.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e99a.bin
1ea4ccaeb568a82ecf94f08ea2db147b65d0ddd6c4616d1785241513345c91d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE99A 5288 bytes
font_01_sfnt_off0000fbc4.bin
31fc958bc6ce96edcecf7932b2c65b6930f1527b98f8c52db3df44a6d9b85209		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBC4 12864 bytes
font_02_sfnt_off000124eb.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x124EB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.