Malicious PDF — malware analysis report

Static analysis result for SHA-256 e10d596c60e7352d…

MALICIOUS

PDF

74.9 KB Created: 2021-04-01 02:37:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 928720f993edd2ad91d2091546f95ca8 SHA-1: 2e2583366adee0946357bb4a0b0e2f0edeea61d4 SHA-256: e10d596c60e7352dfbdbfb58f09c5d076c3e980630d29e8523ce9f5da76f78cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URI pointing to a URL that appears to be a lure for downloading a textbook, but is flagged as malicious by ClamAV and an ML classifier. The presence of the PDF_URI heuristic and the ClamAV detection strongly suggest this is a phishing or malware distribution attempt. No scripts were extracted, but the embedded URI is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/aws?utm_term=the+calculus+7+louis+leithold+pdf
    • https://cdn.sqhk.co/zuxosutuku/ibN4ySE/13720436436.pdf
    • https://static.s123-cdn-static.com/uploads/4376870/normal_5ffdf0fb88306.pdf
    • https://static.s123-cdn-static.com/uploads/4421040/normal_6001bffe2c6d6.pdf
    • http://erogan-encolumbia.site/desarrollo_de_la_personalidad_cuatro_enfoquesrrmwz.pdf
    • https://cdn.sqhk.co/dolubivo/ejanhhH/xazorefate.pdf
    • https://cdn.sqhk.co/bedipidis/YjadhbW/astrology_answers_daily_tarot_reading.pdf
    • http://mmuuue.space/weather_report_today_live_kolkatasmqyz.pdf
    • https://cdn.sqhk.co/komilede/hgjfRij/android_free_tech_news_app.pdf
    • https://cdn.sqhk.co/kakapoxavu/geaxKgd/80963350287.pdf
    • http://supernefritroller.xyz/bofezorilavaluverol7mr.pdf
    • https://cdn-cms.f-static.net/uploads/4465024/normal_602a1d2f1c9a8.pdf
    • https://cdn-cms.f-static.net/uploads/4486206/normal_6034e33fa2a95.pdf
    • http://keepmaxi.space/uniden_homepatrol_2_reviewlh6dh.pdf
    • https://cdn.sqhk.co/tuzevawu/ijclKaE/halloween_costume_ideas_for_couples_and_dog.pdf
    • http://keep-travel.com/post_acute_withdrawal_syndrome_weedefblk.pdf
    • https://cdn.sqhk.co/sifolilo/wjahasE/rust-_oleum_cabinet_transformations_home_depot.pdf
    • http://ubsvp.com/verusunazepubijagopalencznnw.pdf
    • https://static.s123-cdn-static.com/uploads/4483864/normal_6005d23ceabc4.pdf
    • https://cdn.sqhk.co/keropolor/82cShbD/22250225045.pdf
    • http://tryporte.xyz/sword_art_online_alicization_lycoris_update_1.11_patch_notesltrvd.pdf
    • https://cdn.sqhk.co/zabeluzitema/bRSgcJp/make_me_maniac_song.pdf
    • https://cdn.sqhk.co/nowonipewo/hGjduhj/science_journalist_job.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/385f039b-a97e-40af-9b01-7bc6e98ddc42/para_que_se_utiliza_la_linea_de_tiempo.pdf
    • https://uploads.strikinglycdn.com/files/c97d8667-8b79-414a-bd58-02eced64b1df/muwutafixerimiwufunotaviv.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4e7.bin
f9009f96b3a08065e73bad6146516570f723c8f2b09fa6cc39b42c043d5791fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4E7 5176 bytes
font_01_sfnt_off0000f68d.bin
f4730c56fdb0a97fede3302bc13c8a552d232b328a6bffd0ae1210bff3338555		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF68D 11820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.