Malicious PDF — malware analysis report

Static analysis result for SHA-256 de29e2374d10a708…

MALICIOUS

PDF

97.6 KB Created: 2021-06-03 03:25:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2cd9447c409a260b52e6812f3ae06f4e SHA-1: d3bbf69900c501749a45f23e467922aa0b1c11fb SHA-256: de29e2374d10a708b27a1680541cd2d953b2c750d45cb9e9f0b768f721d8d58a
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was identified as malicious by ML classifiers and ClamAV, with a high-confidence heuristic indicating an advance-fee scam lure. The document body, though partially corrupted, suggests a theme related to academic performance, which is likely a pretext for the scam. The presence of multiple external URLs, including one flagged as potentially malicious, indicates an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/pbw?utm_term=causes+of+poor+academic+performance+in+college+pdf
    • https://static.s123-cdn-static-d.com/uploads/4485310/normal_60b11fe79328f.pdf
    • https://fusufuxono.weebly.com/uploads/1/3/1/6/131606103/lujozebamulor.pdf
    • https://nudiwosesi.weebly.com/uploads/1/3/4/3/134317077/jotubobaxowil.pdf
    • https://static.s123-cdn-static.com/uploads/4487416/normal_5fec51315f645.pdf
    • https://vedefagam.weebly.com/uploads/1/3/0/8/130814874/sasitotamo.pdf
    • https://kuwujevo.weebly.com/uploads/1/3/4/8/134864034/6219175.pdf
    • https://duwatazajopi.weebly.com/uploads/1/3/4/2/134235013/segubupupitawapew.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://sozakuvepar.pbworks.com/w/file/fetch/144486975/98835631951.pdf
    • http://tazijebep.pbworks.com/f/which_letters_are_ascenders_and_descenders.pdf
    • http://veweran.pbworks.com/f/problemas_de_distribucion_normal_resueltos.pdf
    • http://gatasulupu.pbworks.com/f/47925387742.pdf
    • https://uploads.strikinglycdn.com/files/8dbb6790-a28a-4694-b3dc-7791b80bd48c/uso_de_la_gramatica_espanola_elemental_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/4de856d4-ae13-4fad-ac3b-c4f6f6e835b6/garmin_vivofit_4_fitness_tracker_black_large.pdf
    • http://nefusim.pbworks.com/f/ser_worksheet_1_answers.pdf
    • http://fuvesiwowegu.pbworks.com/w/file/fetch/144413490/rufegosij.pdf
    • http://mapaduzipi.pbworks.com/w/file/fetch/144529314/how_to_use_acrylic_paint_beginners.pdf
    • https://uploads.strikinglycdn.com/files/4223bb98-31e7-4114-b07d-ab3d0c1c9407/saraswati_puja_mantra_in_bengali_lyrics.pdf
    • http://dajodovilav.pbworks.com/w/file/fetch/144534144/home_design_3d_gold_version_apk.pdf
    • http://zixereves.pbworks.com/f/anatomy__physiology_the_unity_of_form_and_function_9th_edition_by_kenneth_saladin.pdf
    • https://uploads.strikinglycdn.com/files/3bbe0d0b-7720-4923-81eb-955cccd05d55/how_to_weigh_a_bag_without_a_scale.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001325d.bin
1a2522f994a91e71aa4ff71c65d86b4c579dede3425aa500eee59a4e1c84c284		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1325D 5300 bytes
font_01_sfnt_off0001444a.bin
17a2f18c73cc531110a2457d64c5a183873f763dee4cfcc5fedde069e30ffa1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1444A 11260 bytes
font_02_sfnt_off00016a9e.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16A9E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.