Malicious PDF — malware analysis report

Static analysis result for SHA-256 cac3726c1322e3a5…

MALICIOUS

PDF

84.0 KB Created: 2021-04-18 00:19:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 80f5549ad91dfa907c12bed1657de2bd SHA-1: 5187d3f270ffd1465618a2c78fdc364c57e2658b SHA-256: cac3726c1322e3a544b72925c9d3740571a91ed25fd1c53da2035a25735d5ea4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is malicious and a phishing attempt. It embeds a URL that masquerades as a worksheet answer key, likely to trick the user into visiting a malicious site. The ML classifier and ClamAV detection strongly support its malicious nature. No scripts were extracted, but the embedded URI is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=finding+missing+sides+of+similar+triangles+worksheet+answers
    • https://cdn.sqhk.co/womawuxinuge/ikhhigS/11170162583.pdf
    • https://cdn.sqhk.co/rowojazur/b9jhjdU/du_recorder_screen_recorder_video_editor_live.pdf
    • http://fortysgjdk.fun/56397478407c8792.pdf
    • http://topchambre.xyz/anyway_you_can_annette_bosworthaaf13.pdf
    • https://cdn.sqhk.co/baxemazisod/pRigheH/gijujixagadozadikil.pdf
    • http://korecos.ru/vivadazezesutosemiwivh7b6i.pdf
    • https://cdn.sqhk.co/gidowoji/ehcNUfR/minopoxakizopatujeg.pdf
    • https://cdn.sqhk.co/zegofurop/jgVKjiQ/winipagijetipetenanivos.pdf
    • https://cdn.sqhk.co/muzewutipifa/ukbFhfx/ardas_kran_punjabi_full_movie.pdf
    • https://static.s123-cdn-static.com/uploads/4459180/normal_60089d0ae49c1.pdf
    • http://souve.me/rodazitenugedopezijo2.pdf
    • https://cdn.sqhk.co/fujalapevame/jIz9iaH/16202528551.pdf
    • https://cdn.sqhk.co/guwaloxipete/aFibhiP/bingo_cards_online.pdf
    • http://xtina.online/uppababy_vista_sale_canadae4k96.pdf
    • https://cdn.sqhk.co/donuvoduvedo/oOghtiP/jazewopimi.pdf
    • https://static.s123-cdn-static.com/uploads/4495999/normal_5ff6ae0ef2740.pdf
    • https://cdn.sqhk.co/zaviresodew/ghhcZjf/zitemoloxijizizivojeje.pdf
    • https://static.s123-cdn-static.com/uploads/4449397/normal_6003a76c091d4.pdf
    • https://cdn-cms.f-static.net/uploads/4427509/normal_600cc7bb34aa1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9f507278-a081-4ad4-8cce-9b9fefac590e/bonuxofanaketugirol.pdf
    • https://uploads.strikinglycdn.com/files/79fbff5d-cd09-4588-9d10-99c37fd4ee1d/possessive_pronouns_worksheet_year_5.pdf
    • https://uploads.strikinglycdn.com/files/a5406fe9-9a50-49e6-be4e-99c017d2b6b2/why_is_leadership_important_in_early_childhood_education.pdf
    • https://uploads.strikinglycdn.com/files/0fa6e24a-5169-45bc-8b13-d8042d16c9b6/why_is_the_minimum_amount_of_hot_solvent_used_in_recrystallization.pdf
    • https://uploads.strikinglycdn.com/files/19050e2e-78cd-473f-9ed2-4ea2cffd8c51/reloading_powder_for_223_rem.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a01.bin
dbf40206d8ecd51953a4dc02a96d715d1ee33519468837b047f25ee2f77868cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A01 5432 bytes
font_01_sfnt_off00011c67.bin
7f8c90004f710a27776662c536c149294d97ea368c5827b88507885630d34ca6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C67 11428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.