Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5a022191f6d3f25…

MALICIOUS

PDF

72.9 KB Created: 2021-02-22 02:26:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3238edcc5e9ff8d9167ed5cd8a148584 SHA-1: 7ee926b92199478992f613a4e3e70eb46496f5a1 SHA-256: b5a022191f6d3f25a287ae085c3e1601081141a21fcac01cd8c21275c63137bc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely to deliver a secondary payload or phish for credentials. The document body, though partially garbled, suggests a lure related to a book summary.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=the+trial+and+death+of+socrates+3rd+edition+summary
    • https://static.s123-cdn-static.com/uploads/4403417/normal_5ff8ff912a361.pdf
    • https://cdn.sqhk.co/tavaxikanabu/jsgdgda/where_to_buy_wood_carving_knife_blades.pdf
    • https://cdn.sqhk.co/xidujefonari/qihaeks/how_high_are_you_when_you_skydive.pdf
    • https://static.s123-cdn-static.com/uploads/4498882/normal_5fe1bd89c3369.pdf
    • https://cdn-cms.f-static.net/uploads/4493579/normal_6025d1d5e041e.pdf
    • https://static.s123-cdn-static.com/uploads/4411926/normal_6001bcaecf74d.pdf
    • https://cdn.sqhk.co/zajagatetode/v7jjyih/vavew.pdf
    • https://cdn.sqhk.co/faxonudogot/hau3icz/orange_balls_on_my_sushi.pdf
    • http://nemurirewokow.iblogger.org/canon_ipf670_parts_manual.pdf
    • http://linawoninup.22web.org/survival_food_companies_in_utah.pdf
    • https://cdn.sqhk.co/vemudumuxixu/c6Gjdhc/69677048938.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xaxeziru.epizy.com/xatevetakapivi.pdf
    • http://ridabus.epizy.com/jexodisela.pdf
    • http://wegolas.epizy.com/34116608648.pdf
    • https://s3.amazonaws.com/goneduzum/73735777648.pdf
    • http://waxaravibew.epizy.com/bratstvo_crnog_bodeza_15.pdf
    • https://s3.amazonaws.com/xeropizuwe/67349492102.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e05e.bin
8690df66b7838220b350b4c0cd44c83ad62e2f7691f86c3319d5c79c49d455d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE05E 5476 bytes
font_01_sfnt_off0000f2db.bin
c6a3306751743ac8e8d4ae8b8f909c1d4d6fec30d95487d184774da1aa4f17c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2DB 10456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.