Malicious PDF — malware analysis report

Static analysis result for SHA-256 b63092b6c0185f42…

MALICIOUS

PDF

93.9 KB Created: 2021-07-13 18:52:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 6981745130901cdcfcdb32e60816154b SHA-1: fd956f293a5f97ba2c147d1ef04b8dd31e8194a3 SHA-256: b63092b6c0185f427bc439aeb368b472c529feadf205168dfd611182fba767b6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating phishing and trojan characteristics. The PDF contains embedded URLs, one of which is flagged as potentially malicious, suggesting an attempt to redirect the user to a harmful site. Although the document body is heavily obfuscated and unreadable, the presence of embedded URLs and the malware detection strongly indicate a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/IdU8rIDf9lQ/square?utm_term=important+days+in+february
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ecabfe80388a1034dafb0a/1626123262846/places_near_coorg.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e95c681448b061984a232e/1625906280356/plotting_points_on_a_cartesian_plane_worksheet.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec8abeb6dedd3ae169918f/1626114751280/queen_bees_and_wannabes_free_download.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ed4339f95b5524f95184a0/1626161977623/saduxarozifuvowewefepomal.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e84bcc17066f6fb131dd83/1625836492340/30627837591.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e87aca4c7026582e9dd2f6/1625848522490/trapped_nerve_in_right_side_of_back.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e867959e7b2b76b55b5003/1625843605087/the_supremes_santa_claus_is_coming_to_town.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ed4dbb2271a75a72d17a65/1626164667566/pekajevafukuxilikiw.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e920c4320dbd0de280fa02/1625891012289/drinking_games_with_a_deck_of_cards.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e8a880c2f4e855af972994/1625860224828/what_is_the_additive_inverse_of_17.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e8184795719b356d953da1/1625823305694/22257156333.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e77aa7906000174a5f4eaf/1625782951932/how_do_i_stop_cheating_on_my_wife.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e7b8be7be683581ce0d9ff/1625798847018/gangavalli_assembly_constituency.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010dcc.bin
7b22b420ef68da9003cf14f34937e71e57b61943cac2ce0ba92283511ef8e775		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DCC 16968 bytes
font_01_sfnt_off000139fb.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x139FB 16792 bytes
font_02_sfnt_off00015212.bin
b457567eafd36457e06a34b52bd05db924a668ad880f44a4c99e5d8976f759d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15212 10920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.