Malicious PDF — malware analysis report

Static analysis result for SHA-256 b92122125cfbc199…

MALICIOUS

PDF

76.0 KB Created: 2021-04-03 08:33:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 155c01e740f14ebf630e7ecca46e2fe4 SHA-1: d1ca2bd6d5053f66fbde1cdaa216502d608df496 SHA-256: b92122125cfbc199fa0420a35a7fb01cdd261b89266aec005ef3fb63b98a557d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to be a lure related to educational content, likely intended to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=simplify+fractions+worksheet+with+answers
    • https://static.s123-cdn-static.com/uploads/4469386/normal_6007b9e8a9561.pdf
    • https://cdn-cms.f-static.net/uploads/4387698/normal_6050eff448973.pdf
    • https://cdn.sqhk.co/fusojafiza/jdLewhb/free_music_to_use_for_instagram_videos.pdf
    • https://static.s123-cdn-static.com/uploads/4412387/normal_6000d870b59d9.pdf
    • https://cdn.sqhk.co/minederepa/y8UNcjb/bet_movies_list.pdf
    • https://cdn.sqhk.co/bikegola/QgeK6lp/block_puzzle_jewel_score.pdf
    • https://cdn.sqhk.co/numiwuzuwix/gehdTjb/xovedejifisaxifuge.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wovisak/highlights_hidden_pictures_answers_december_2019.pdf
    • https://uploads.strikinglycdn.com/files/1117cd42-205f-4ebc-930c-fa7a871bec13/gewezulifodasika.pdf
    • https://s3.amazonaws.com/zubuwujoxom/sunbeam_aroma_coffee_maker_pc7900_manual.pdf
    • https://uploads.strikinglycdn.com/files/de8f7765-d31d-464a-9bb2-d245f5ddf492/pokezibepavomin.pdf
    • https://s3.amazonaws.com/bejexe/java_windows_7_ultimate_32_bit.pdf
    • https://s3.amazonaws.com/zafijukopa/59969775705.pdf
    • https://s3.amazonaws.com/gazivemon/how_to_see_duplicates_in_google_sheets.pdf
    • https://s3.amazonaws.com/bejenosugede/nipegiwawofem.pdf
    • https://uploads.strikinglycdn.com/files/d3309c9c-3fd5-465a-af62-a80155893df3/everstar_air_conditioner_parts.pdf
    • https://s3.amazonaws.com/fujadabez/84600384906.pdf
    • https://uploads.strikinglycdn.com/files/20ce56ec-91e7-4d11-a503-cd3daa2ba459/char_griller_pellet_grill_instructions.pdf
    • https://uploads.strikinglycdn.com/files/30b8b27f-b34a-4535-a45b-540bdec53466/tavug.pdf
    • https://uploads.strikinglycdn.com/files/45e27da6-85aa-4693-966e-41c7a8dc4fd6/delta_12_portable_planer_model_22-540_parts.pdf
    • https://uploads.strikinglycdn.com/files/fccbbbfd-cda0-49c5-955f-15e4d53c9532/8347092021.pdf
    • https://s3.amazonaws.com/kefefetafij/xaputed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecaa.bin
4bde8ed1bf475bdb25ef02601ab4e47b57413b4916af520cadab8d197a89276c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECAA 5616 bytes
font_01_sfnt_off0000ffb2.bin
df6dbbece00bf6523690ed41e8c1689bf04be791a154dddbb2e9ef52e9ec26d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFB2 10284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.