Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4d9f651af2c1742…

MALICIOUS

PDF

71.7 KB Created: 2021-07-14 08:16:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 68b898de05bd6c7b3b3ed6caab901450 SHA-1: 4c96317f3807a0a3a01e40e97ff5029bd1b1c88c SHA-256: d4d9f651af2c1742c28487c22066686b82434d933878d0b979ad90a81e976e3b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs, despite some being marked as benign, suggests an attempt to redirect the user to potentially harmful content. The PDF structure and embedded artifacts are consistent with malware delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6583

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/pL_UGxDroB4/square?utm_term=icd+10+for+myofascial+pain
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60eddc9937ddb5439bf696f9/1626201242215/guided_relaxation_script.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e821e97e45264421fb75e3/1625825769392/briar_cliff_physical_therapy.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec8cb369d4b63361479bc6/1626115251413/62091183878.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bd4d.bin
c253d9d87a73cd3f90f6c4d332471b2e47a01d3f2692feea4c551812bf6670c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBD4D 14740 bytes
font_01_sfnt_off0000e295.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE295 16792 bytes
font_02_sfnt_off0000faac.bin
35495b342252d90b9321e88c176c1c8d52a2de9204e546ad5c9911b13314cd47		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAAC 10792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.