Malicious PDF — malware analysis report

Static analysis result for SHA-256 d88b90f49c408075…

MALICIOUS

PDF

75.2 KB Created: 2021-03-24 17:18:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c555ae81ef332e03379b1911382e46ec SHA-1: d964e61cc37d87a6a91df002ec4588ebc9fbb021 SHA-256: d88b90f49c408075a9a237b65e27119049b0279df66ce495998ac67f0555b679
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a phishing or malware distribution site. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'award' and 'antologias upn le 94 pdf'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=antologias+upn+le+94+pdf
    • http://xoridamewok.iblogger.org/94172990039.pdf
    • https://static.s123-cdn-static.com/uploads/4467003/normal_5fe0f533195e7.pdf
    • http://vizexibidoxi.getenjoyment.net/ver_pelicula_el_mundo_de_sofia_en_espaol_latino_gratis.pdf
    • https://cdn-cms.f-static.net/uploads/4478430/normal_6030df8bbaa0b.pdf
    • http://vejefulolite.22web.org/jkuat_admission_letter.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/92349bd2-d74e-4d69-b50e-779f65e28b28/2nd_grade_math_books.pdf
    • http://vunefukovamin.rf.gd/similar_figures_worksheet_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/578a2380-6988-47c4-a255-94ec02a41706/purpose_in_writing_orpheus.pdf
    • https://uploads.strikinglycdn.com/files/b14b48ac-5b6d-47bc-8fb7-ecb5bbbcbf8e/arcgis_basic_tutorial.pdf
    • https://uploads.strikinglycdn.com/files/4bd4e70d-bc61-438b-ae57-75f38544535e/24157785158.pdf
    • https://uploads.strikinglycdn.com/files/62958075-0855-4e34-98b3-5a8284be4941/tracfone_lg_premier_pro_plus_smartphone_reviews.pdf
    • https://s3.amazonaws.com/libowebujakux/free_alphabet_tracing_worksheets_for_toddlers.pdf
    • https://uploads.strikinglycdn.com/files/430bdc10-b752-4f4d-b90e-da8798c2b674/gogowina.pdf
    • http://nekelaxowe.atwebpages.com/essential_word_for_toeic.pdf
    • https://s3.amazonaws.com/somamere/icai_articleship_exam_admit_card.pdf
    • https://uploads.strikinglycdn.com/files/1834e519-f15d-4954-9f37-27b91e077ce5/how_much_does_an_interior_designer_make_a_year_in_canada.pdf
    • http://tavamikilav.myartsonline.com/1990941348.pdf
    • http://godakumezaguf.rf.gd/gixejunumizedejogazuzow.pdf
    • https://uploads.strikinglycdn.com/files/9af5e63f-5512-4624-8f05-9913f3566bb9/61017529934.pdf
    • http://rufizugo.epizy.com/cryptopia_app_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e94a.bin
422c66d29fc63a5ec70bae7510937c8feaceb567e21a2a8adaaff1e7cecc4085		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE94A 5344 bytes
font_01_sfnt_off0000fb96.bin
776765ffd1fd415e8bec7dac5049178ac44c97df4bae3df9d3b30c9132a778d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB96 11184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.