Malicious PDF — malware analysis report

Static analysis result for SHA-256 da6bd83e9c22f734…

MALICIOUS

PDF

75.8 KB Created: 2021-06-03 23:55:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e95707050d62afbc2420d549b754a39 SHA-1: ad616d0c51121327f8dabb833924d96bf5987be1 SHA-256: da6bd83e9c22f7340adc1b38cf78b5eb793646e1e641efe312f44398e3cf2bb1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL points to a domain that appears to be part of a phishing lure, using a seemingly legitimate topic to entice users. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to redirect users to a potentially harmful website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=abbottabad+university+ma+date+sheet+2019
    • https://static.s123-cdn-static.com/uploads/4472216/normal_60013b6fb5ba5.pdf
    • https://static.s123-cdn-static.com/uploads/4392861/normal_5fef432d5f0ad.pdf
    • https://cdn-cms.f-static.net/uploads/4410462/normal_6024f790cca75.pdf
    • https://cdn-cms.f-static.net/uploads/4369333/normal_5fdc16e4a059b.pdf
    • https://cdn-cms.f-static.net/uploads/4477630/normal_5fe882d7ee191.pdf
    • https://static.s123-cdn-static.com/uploads/4460706/normal_6007fca280b83.pdf
    • https://cdn-cms.f-static.net/uploads/4459337/normal_60615a9824b56.pdf
    • https://cdn-cms.f-static.net/uploads/4447874/normal_606d59b1ed607.pdf
    • https://cdn-cms.f-static.net/uploads/4370768/normal_605fb2fc819c8.pdf
    • https://cdn-cms.f-static.net/uploads/4495055/normal_606a2a9766dba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fatakalewene.pbworks.com/w/file/fetch/144501960/actividades_de_lectoescritura_para_tercer_grado_de_primaria.pdf
    • http://tozuxexap.pbworks.com/w/file/fetch/144525486/lovomawofara.pdf
    • http://xovakovawup.pbworks.com/w/file/fetch/144521838/5_senses_used_in_descriptive_writing.pdf
    • http://viluxese.pbworks.com/f/lutekavalogalafapudi.pdf
    • http://tusawijer.pbworks.com/w/file/fetch/144460911/mebudefunazazo.pdf
    • https://uploads.strikinglycdn.com/files/a065653a-6628-42b4-bf77-bfefa8fdd748/18925052517.pdf
    • https://uploads.strikinglycdn.com/files/3d1755b2-7b7f-491e-a728-a8f3fd2af6bd/nabidozixuwawuniwiputam.pdf
    • http://zikupuzajix.pbworks.com/w/file/fetch/144449769/need_for_speed_most_wanted_2005_pc_hd_mod.pdf
    • http://mujefapufefi.pbworks.com/f/18136071066.pdf
    • http://fuxedemama.pbworks.com/f/how_to_light_a_york_diamond_80_furnace.pdf
    • https://uploads.strikinglycdn.com/files/b90ef296-a6e5-45f6-b8fa-9041a37d71a0/18750906705.pdf
    • https://uploads.strikinglycdn.com/files/83599856-34c1-4ed0-b6cf-3f48079e13ea/kavoboba.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea21.bin
6ec3a8725855ceb23898811a92a2dc7ad98ff0ccd62d5f3d1d4de17dcafc1435		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA21 5804 bytes
font_01_sfnt_off0000fdc0.bin
c41bd07cb46cdb15e82f2c40f628667c067761c3f5ee81c8325f719d4f9ea515		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDC0 10656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.