Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd575ddf73e28dfc…

MALICIOUS

PDF

92.3 KB Created: 2021-07-12 20:42:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 6b8c109937c4455463f029dfa759732f SHA-1: 582765aeb9117d7303f1ffeaef3222924db3a3c2 SHA-256: dd575ddf73e28dfc05b9548334f726a1fb1f20c773101933dfe6642ca9ca1788
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a phishing trojan by ClamAV. It contains embedded URLs that, while some are marked as benign, suggest an attempt to redirect the user. The PDF structure itself is also flagged for duplicate object bodies, indicating potential obfuscation or malformation.

Machine Learning

  • Nyx PDF Classifier clean score 0.1542

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/UZrB20b2Dcg/square?utm_term=how+to+turn+off+screen+time+passcode+on+iphone
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec7eb959713006cbe0da5b/1626111674081/how_to_restore_deleted_messages_in_messenger_android.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e7e1a34aaab0286a8adcbd/1625809315502/88518105379.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010196.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10196 16792 bytes
font_01_sfnt_off000119ad.bin
d6944a4550114557f5b070817af956f45650d97da36dc3b9ece60fbc9be3612b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119AD 11016 bytes
font_02_sfnt_off00013321.bin
9fba54766f94adef26ea480b3391f87c129d6e7702facb7868cb936581acb5ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13321 18508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.