Malicious PDF — malware analysis report

Static analysis result for SHA-256 d346770b5591be3b…

MALICIOUS

PDF

74.9 KB Created: 2021-05-23 22:40:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 131313e834ff95cea16a2b902d7b5967 SHA-1: e0535b8ba27ba9bbcec81468cff088cb70b409d1 SHA-256: d346770b5591be3b14f7af08e63f4931a7f687fd1df22228c9cf14e105c736ea
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text related to search queries, and an external URI points to a URL that mimics a search result for educational materials. This suggests a phishing or social engineering attack designed to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wb?keyword=singapore%20math%20worksheets%20grade%204%20pdf
    • https://cdn-cms.f-static.net/uploads/4455907/normal_601fffb8e11f0.pdf
    • https://static.s123-cdn-static.com/uploads/4369331/normal_5fdf8126eb5a7.pdf
    • https://cdn-cms.f-static.net/uploads/4404297/normal_6052a7f32a4de.pdf
    • https://static.s123-cdn-static.com/uploads/4379237/normal_5fcf7c3c4dc0c.pdf
    • https://cdn-cms.f-static.net/uploads/4457838/normal_5fda1aaf54de3.pdf
    • https://cdn-cms.f-static.net/uploads/4383577/normal_60304b9cc7485.pdf
    • https://static.s123-cdn-static.com/uploads/4471234/normal_6001d578065ff.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2abd1ec8-d59a-4120-b03e-47996cf66b7c/best_single_deck_blackjack_strategy.pdf
    • https://uploads.strikinglycdn.com/files/3118f281-117a-4466-bbcf-bc8822b98385/97184994119.pdf
    • https://s3.amazonaws.com/tufujifinobiro/amana_commercial_microwave_1700_watts.pdf
    • https://uploads.strikinglycdn.com/files/5ca80a59-4c08-46e1-8adc-4ff32cd1e425/free_download_nitro_professional_full_version_32_bit.pdf
    • https://s3.amazonaws.com/lewuli/97234228632.pdf
    • https://s3.amazonaws.com/zisulamisozoto/canon_printer_scanner_driver_free.pdf
    • https://uploads.strikinglycdn.com/files/4a8f858c-dc1b-4256-8189-5e54624cb230/17435040597.pdf
    • https://s3.amazonaws.com/zikeko/rizabuvikafiratu.pdf
    • https://uploads.strikinglycdn.com/files/7a08939b-f32f-4276-b768-c5ee91dfba04/taurus_pt111_pro_g2_9mm.pdf
    • https://uploads.strikinglycdn.com/files/c63ce908-fde4-46bd-84e2-aadb2a370e86/somesekupogisi.pdf
    • https://uploads.strikinglycdn.com/files/a9a6b1c9-99d9-416a-bf68-9441c9558bbe/senior_geotechnical_engineer_job_description.pdf
    • https://uploads.strikinglycdn.com/files/8620029a-ddac-4eae-a3a6-cf303a8e429b/zitivagod.pdf
    • https://uploads.strikinglycdn.com/files/d4efb4d5-4dd8-4ea2-92d9-3321bd446e30/62667063556.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6a7.bin
2ef3bed5880243c5a334e14dd9e56541078b72c6121185d5869b3933458cc37a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6A7 5772 bytes
font_01_sfnt_off0000fa3c.bin
92b9f259cfe35f820fd287b5415a5a66899b9300ba817b3a0a39e17a2ae0d330		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA3C 10516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.