Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7bcc62ce112fa0b…

MALICIOUS

PDF

78.5 KB Created: 2021-07-13 16:21:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8f102944e284e5a647719e820d5d046c SHA-1: 505101a63d1ff209bf2a8e1b11e154f3e5be2f58 SHA-256: d7bcc62ce112fa0b5e63a711c29add95b705f1b8d878435b20bce4f201114087
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by ML classifiers and ClamAV as malicious. It contains embedded URLs that likely lead to malicious content or phishing sites. The presence of embedded URLs suggests an attempt to direct the user to a compromised or malicious external resource, aligning with phishing or malware distribution tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8740

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/cEZ-xJcQpFE/square?utm_term=french+canadian+women%27s+names
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec7a5d950202184f0f88e6/1626110557953/73644251760.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e9462c8fb24157da714552/1625900588572/17539194742.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e7c3b2fdc75e32ab066e39/1625801650279/70955228199.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e76fe15a6a8d402455ae62/1625780193636/lacto_ovo_vegetarian_meals.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8e8f137da2614570b2dfe/1625876721958/jimawafaneruvomowav.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e8f8718915684aa53b79e8/1625880689841/how_fast_can_u_go_on_a_spare_tire.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d650.bin
8e03ad9a3369c2e2760e685ee203ad09e1042811b159b52503f8c4baa8499283		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD650 10588 bytes
font_01_sfnt_off0000ee5a.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE5A 16792 bytes
font_02_sfnt_off0001066c.bin
705c495263a9421bddfef6b3be05c907a5da59621561bd401f5ece56cedc586f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1066C 15732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.