Malicious PDF — malware analysis report

Static analysis result for SHA-256 c032c52ab1655ce9…

MALICIOUS

PDF

74.9 KB Created: 2021-06-09 12:58:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3a6f2451b0556b5019c60ef856f21b52 SHA-1: 6a1360f8045b8e04b3b7d4085bef098c70f029a1 SHA-256: c032c52ab1655ce90bbfc7def506750b4d52e6b5fcbd809f356a88e4f7ac1a1f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by both heuristics and a machine learning classifier as malicious. The ClamAV detection further confirms its malicious nature, flagging it as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, likely as part of a phishing campaign or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/pbw?utm_term=surface+and+volume+of+sphere
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/eb29135e-7d83-4c1f-b3d6-c442a2329947/how_wide_is_a_langstroth_frame.pdf
    • http://jezopisi.pbworks.com/w/file/fetch/144666579/possessive_adjectives_esl_lesson_plan.pdf
    • https://uploads.strikinglycdn.com/files/21139662-1f64-4393-8f0e-37302f5a0eae/39709372801.pdf
    • https://uploads.strikinglycdn.com/files/d34a76e9-05ff-41a3-93b9-58e1d6fba7a4/time_warner_cable_remote_jobs.pdf
    • https://uploads.strikinglycdn.com/files/e765f913-5c65-40d8-aa11-f9c15cfbb532/jobisezefefim.pdf
    • http://zezimin.pbworks.com/f/street_dance_of_china_season_2_winner_mentor.pdf
    • https://uploads.strikinglycdn.com/files/e68c0c3b-d61f-4b7b-94fd-2d3af0e90688/kyocera_duraforce_pro_hard_reset_att.pdf
    • http://febokipup.pbworks.com/f/will_echo_alarm_work_without_wifi.pdf
    • https://uploads.strikinglycdn.com/files/931f7326-376f-4dbf-8bbc-01d8024cb417/thank_you_maam_answers_commonlit.pdf
    • http://fodorafirig.pbworks.com/f/mawedawakufuvisale.pdf
    • http://doxawadar.pbworks.com/f/70928405821.pdf
    • http://lojefizowoj.pbworks.com/f/fazer_arvore_genealogica_no_excel.pdf
    • http://disisopaz.pbworks.com/f/how_to_cook_a_whole_chicken_in_a_turbo_convection_oven.pdf
    • https://uploads.strikinglycdn.com/files/37b28c2b-f7be-410e-9663-d2c713f8c508/which_intermolecular_forces_are_present_in_solid_co2.pdf
    • http://nadupodifado.pbworks.com/f/trx_beginner_workout_amy.pdf
    • http://junerew.pbworks.com/w/file/fetch/144615291/lajegegutajokipes.pdf
    • http://tagexoba.pbworks.com/w/file/fetch/144741624/nigeria_defence_academy_2021_form_out.pdf
    • http://xeninexiruvo.pbworks.com/f/19801052116.pdf
    • http://rujuboxu.pbworks.com/f/12_steps_of_surya_namaskar_with_pictures.pdf
    • https://uploads.strikinglycdn.com/files/28a51c50-c27b-4f36-8271-6b785724bc3b/kezifogojelodadun.pdf
    • https://uploads.strikinglycdn.com/files/287819af-df2c-4aa9-8d50-b61a62717dd6/elements_of_chemical_reaction_engineering_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e362.bin
32346424692bb3e995cef6ac3615296efa13790110c56bc39433f54bfd689a2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE362 5556 bytes
font_01_sfnt_off0000f626.bin
30f8dd17f24856be725663057e66558469f9d86155ca6cf747aa3c1a82cff078		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF626 11904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.