Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddcab823a132a0f1…

MALICIOUS

PDF

85.9 KB Created: 2021-07-14 04:32:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 026bd70d72fe8e7d4cddc12dd015397e SHA-1: 6019aedd1377679bb78956190d27108b15907f6e SHA-256: ddcab823a132a0f1f5bc70025d5981eb7fe65823f6b25f8f350fecae7100aff6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged the PDF as malicious. While no scripts were extracted, the presence of the external URI suggests an attempt to redirect the user to a malicious site, likely for phishing or to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8239

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/square?utm_term=liability+meaning+in+business
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec9f93a1b53f2c22608699/1626120083994/social_media_advantages_and_disadvantages_in_tamil.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e79f1cdbc52028c83c1111/1625792284782/low_platelets_medical_term.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec91709a1cf201f805d15d/1626116464850/vazerimirevixolokosin.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec815ea1f8f93f64ab949c/1626112350968/31120585556.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ec87467726b430b4689b03/1626113862549/wetukesejafozalo.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8c8b04c181567023cab22/1625868464577/pazeki.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f050.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF050 16792 bytes
font_01_sfnt_off00010862.bin
43202dbb712d4980cf5c731faf8308dd6c0649b74334dbc706fc5e96b74e1e89		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10862 16788 bytes
font_02_sfnt_off000133ea.bin
7672fbea17229aff4d0bf76b6ca63f7a6d2196f482cace47564440254b2a157a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x133EA 10540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.