Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc26f0bff9486e00…

MALICIOUS

PDF

82.0 KB Created: 2021-07-13 01:54:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 91c71b55f7cd76b3444b550a24d9ec93 SHA-1: 644a287d5ddd9a6353027fe372eed9d90f8d5481 SHA-256: cc26f0bff9486e00c07fdcfe91e905025b8da3b67bf2bd5e665b87d2942c701e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF_URI heuristic identified an external URL, suggesting the document may be used to lure users to malicious content or phishing sites. While no scripts were extracted, the overall structure and detection suggest it's a downloader or part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/iXsW93xxTQA/square?utm_term=is+state+disability+taxable
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ecb2cb4d4a7853b7157bd6/1626125003241/conduction_convection_radiation_definition.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8d62da0ce97462827ea29/1625871918276/99251565378.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e784216544141053fe8c40/1625785377906/sisepulusovupaxapaludavub.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec8e0e05183b3b579e0f3d/1626115598503/a_sentence_that_contains_at_least_two_independent_clauses_is_a.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8e1b883ae0c490235a3cf/1625874872841/biogas_is_made_from.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec8a9fff9c8b53cea3299c/1626114719675/terlingua_ghost_town.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ecc3591ae59f50d9296c60/1626129241464/33038453657.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e76ce726d1b15707cf1b35/1625779431698/diggin_it_all_boxes.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ecb5875b92cb3d5f9edf6f/1626125703358/stimulation_meaning_in_tamil.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec8e411996685841a97421/1626115649581/81252483780.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec934e704a383bbedac470/1626116942879/shadow_and_bone_read_online_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0ff.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0FF 16792 bytes
font_01_sfnt_off0000f916.bin
ca16767440eb1c9d8a440df419042641f8e061b3c00d73767e815a43d78e4e05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF916 10224 bytes
font_02_sfnt_off00011025.bin
839df1dab607e698756255e43990c2d4a3efdceaa754eb236707fb95427cd106		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11025 16824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.