Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1b91bb12786783b…

MALICIOUS

PDF

91.2 KB Created: 2021-07-21 14:48:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 5ceb455584e3bb8ff0c74f88457cc046 SHA-1: 131f242b1c0346b9a90760b90bc2ee52f8b92242 SHA-256: e1b91bb12786783b4375d609c09fa0db259066c4c13005e77bb96b98c247f684
106 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document that exhibits characteristics of an advance-fee scam, including language related to prizes and parcel delivery. The ClamAV detection and the presence of embedded URLs further support its malicious nature. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of its specific payload or delivery mechanism.

Machine Learning

  • Nyx PDF Classifier clean score 0.2245

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/IdU8rIDf9lQ/square?utm_term=should+i+text+him+goodnight+every+night
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f09a0493092e27c5cd71c2/1626380804786/6272782791.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f1184ae9ec2a4c2bd93c46/1626413130182/dominant_submissive_relationship_meaning.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee220502e0767984f185db/1626219013654/jawatagus.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f1921992add85d2eeaf8d2/1626444313365/punip.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea41.bin
9f10bc01548486e8ef5a53236354657526d8cd6e4cd8c8f4d4a5c43d4c34e5b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA41 10824 bytes
font_01_sfnt_off000102dc.bin
9f8abae0fe7b07cdd6e3c580dacea71229cddb349c51f6f496bf47f8d38b8329		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102DC 16660 bytes
font_02_sfnt_off00012e03.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E03 16792 bytes
font_03_sfnt_off00014614.bin
73519f33ba9c166aa369807b1853e752697b584a5a22b2dc9e0c0c5a51984258		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14614 17468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.