Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb8da7aa873e0940…

MALICIOUS

PDF

151.2 KB Created: 2021-07-13 17:21:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: e28ecb3dfc0ea406117fe713f43fc421 SHA-1: 00bd746ab37869b81dd892d5b576963d10cda7d6 SHA-256: cb8da7aa873e0940e83e6aedaaf79f4119e775c8bdfd3a4d142bd9a40a938b6d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was identified as malicious by ClamAV with a specific signature indicating a Pdf.Phishing.Trojan. The presence of embedded URLs, although many are marked as benign, suggests an attempt to lure the user to external resources. The ML classifier also flagged this PDF as malicious. No scripts were extracted, but the PDF structure itself is indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5355

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/r_nBws6J8g8/square?utm_term=dns+configuration+in+windows+2003+server+step+by+step+pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec93f2e7718717d763632a/1626117107020/g_codes_in_cnc_programming.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e949f8c4c1a734c5d82a7a/1625901560892/pokemansion_fire_red.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e81e3597884458c9a45edd/1625824821567/tom_and_jerry_landing_stripling.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec9e3083836e7a7d633739/1626119728198/zatosu.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec9eccc426b81e83025ad0/1626119884851/clothing_synonyms_in_different_languages.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001eb00.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1EB00 16792 bytes
font_01_sfnt_off00020317.bin
089944ac72d6fe065d08acec9d2d79c17aad4a68794dc4ebdb533d8c1fb53b8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20317 11672 bytes
font_02_sfnt_off00021ec7.bin
bd2629f07f0eb33efc22b50003c4f5b96aa9bf737d193be0d87c923b3df57e1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21EC7 18456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.