Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce0bf158c5e5bdd9…

MALICIOUS

PDF

83.1 KB Created: 2021-07-21 17:32:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 2d8e81b56acf10d22f752d18444d6c1a SHA-1: aabe93e62a1f4c18d35118c462ac3f03da491a85 SHA-256: ce0bf158c5e5bdd984de15ce9ec97643e42d49728b1b89e3b7ea6121a4e513bf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a phishing or trojan threat. It contains embedded URLs, one of which is associated with a phishing lure. Although no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/ZFaGRQ6RLlg/square?utm_term=ajax+post+form+data+example
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60eca99c7d354a5e86a69508/1626122652599/past_tense_of_choose_in_english.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f7d73295055530dd198aed/1626855218585/government_paying_for_college.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f3849b51c2e8609852ac3c/1626571931886/lilekinekimi.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f4b6d71db272198fa77c84/1626650327200/43465172411.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f09409dba7d633e3c06ea8/1626379273704/88613615632.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e8c0c6b009f83b07551bd1/1625866438764/54076061465.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f733d316b9526a1d2d7221/1626813396158/duzuje.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f291b1503a216717895ec0/1626509745871/euro_dollars_are.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f05a3395008556a28376b1/1626364467864/73740332742.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e7c5311d61f435cef6cbe4/1625802033745/looking_out_of_my_back_door.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f6078aeda7674dad289bf8/1626736522395/jejamamonovi.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f23efcebca9b5ae8e0be61/1626488572737/comprehensive_blood_and_cancer_center.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f3e5d33a33e4096de1b177/1626596819689/how_to_make_your_word_document_into_a.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e86e77cb038805fe1e1ceb/1625845367896/2979910971.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e93faab67368755968b593/1625898922988/intended_audience_examples.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e93d483f195e1e40373444/1625898312633/dawal.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f45294952f835132deb470/1626624660248/area_between_curves_with_respect_to_y.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f797e1be79d63b81eb89a4/1626839009410/class_d_airspace_sectional_chart.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f48859bb7e64222d05442b/1626638425121/eastern_carryout_delivery.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f2ce6be13ee9766601b5c9/1626525291715/check_mark_in_powerpoint_2016.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee230e7426fb5109f2e28a/1626219278194/rofetanizawufi.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ededfda50f6e33a32604ba/1626205693407/juvipofoxomutixemogujosaz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df8f.bin
b8fa2d89b0aaaff5cfcf754a2625ec8da90f653a0a9ba3498d4276b9c7f36e7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF8F 17556 bytes
font_01_sfnt_off00010e0f.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E0F 16792 bytes
font_02_sfnt_off00012626.bin
b3546ba665fe35e842d655aadf37bdb22cd408f8676bd62e8059b31331f2c3db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12626 10676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.