Malicious PDF — malware analysis report

Static analysis result for SHA-256 c25d862ca2863661…

MALICIOUS

PDF

78.1 KB Created: 2021-03-14 01:15:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9058e63e5f5fdd45393b92f9cb9637ee SHA-1: 7022befdc04ee68e0f0ce9194a98eb2b90fcd4b4 SHA-256: c25d862ca2863661dd031e81b641e81aa7abfdd3df8943d394f936c0143f2271
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a malicious site. The document body, though heavily obfuscated, suggests a lure related to a 'gram stain lab report introduction'. No scripts were extracted, but the PDF structure itself facilitated the malicious URL embedding.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=gram+stain+lab+report+introduction
    • https://static.s123-cdn-static.com/uploads/4367013/normal_5ff31bc777627.pdf
    • https://cdn-cms.f-static.net/uploads/4387241/normal_603e9e97dbc35.pdf
    • https://cdn.sqhk.co/dukasavubu/idsJXgc/344109616.pdf
    • https://cdn.sqhk.co/bexuxoxabim/2hedic0/7082345748.pdf
    • https://cdn-cms.f-static.net/uploads/4414848/normal_601868314013a.pdf
    • https://wabelurotetef.weebly.com/uploads/1/3/4/6/134693048/kujavabilije.pdf
    • https://cdn.sqhk.co/dejojoduzi/d9Xjdjh/giro_women_s_mountain_bike_gloves.pdf
    • https://gawudizilox.weebly.com/uploads/1/3/5/3/135300959/taxawu-lobutoxekatidu.pdf
    • https://xidokuwu.weebly.com/uploads/1/3/1/4/131453793/voboweji-voniwebumufo-zubutadededodi-todomokuwef.pdf
    • https://cdn.sqhk.co/giwumazusew/hiljchh/old_snake_toy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f21ecc88-0831-493e-9c57-6e94ab0472dd/8345904594.pdf
    • https://s3.amazonaws.com/divelatoxa/do_wifi_extenders_work_with_fios.pdf
    • https://uploads.strikinglycdn.com/files/50b8ae81-bac6-4bc1-a9b3-4d51bf9b545a/48804692525.pdf
    • https://s3.amazonaws.com/defipedibe/mifujemusexesene.pdf
    • https://2e03c77f-99cc-4591-9807-54d8d49c9ce6.filesusr.com/ugd/759733_e03feb7b9f5649a7802683f68486823b.pdf?index=true
    • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_42fbbce1c97d469293061e3171a5c2ee.pdf?index=true
    • https://0f0532cb-4478-41f9-91a1-cf277c4732ec.filesusr.com/ugd/8acad3_98c43a4eaedb459798f9e030ddc9a442.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ee7326a6-dacc-49fb-971e-a656e82a2ec3/plain_english_for_lawyers_by_richard_wydick.pdf
    • https://adc67df4-9ac4-4169-8225-f8d60376216a.filesusr.com/ugd/a1c2c7_5aaa98c43ddf4f93824190e36e6dc237.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4f3.bin
af927ffba572bcbac60ffca620c80703eb6aece749a350908f2861d9ce83be03		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4F3 5388 bytes
font_01_sfnt_off00010725.bin
d357bead286dd55ac832c3e4594a27e675ebe660d8ade9cb9fff508c49c7d322		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10725 10684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.