Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2a1be270be8abd2…

MALICIOUS

PDF

107.7 KB Created: 2021-07-16 08:41:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 2039aa5efe171b17ddc1dd1c08412b76 SHA-1: 903d8246a18847f910719022334b75ea868dfb83 SHA-256: e2a1be270be8abd27f88e96dee35ba768136234fdd585a1df0a5a4d2b34e83a3
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was identified as malicious by a machine learning classifier and ClamAV, with heuristics indicating an advance-fee scam lure. The document body was heavily obfuscated and unreadable, but the heuristics strongly suggest a phishing or fraud attempt. No scripts were extracted, and the embedded URLs were confirmed as benign, indicating the maliciousness is likely contained within the PDF structure itself.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9846

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/-MXWpcYQ7kA/square?utm_term=online+casino+promotions
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f0972eefae407d2489789b/1626380078177/how_to_make_him_chase_you_texting.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec838e31b0b43e07e6d07a/1626112910654/85796192507.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec8f5958d864752e01ef1a/1626115929527/what_makes_someone_bisexual.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f0d5f58bcf896c915ab22c/1626396149600/meaning_of_impartible.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee88cfa005482cc15a8491/1626245327800/b_complex_and_amino_acids_injection.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ee7732db6052518ec9cb56/1626240819122/the_power_of_subconscious_mind_book_summary.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee2da05f7927514e3c0fae/1626221984543/13789603878.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f0ae95629a5a0ea0106a7d/1626386070148/xinoxenevopifugeze.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e8e6e366be7e490f0cc7b9/1625876195338/army_gd_math_question_paper.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000144a6.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x144A6 16792 bytes
font_01_sfnt_off00015cb8.bin
27ef92c54525717bdb62dc2f4a10ac6ab2933635465604efa3eeda5f1c2f02b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15CB8 17548 bytes
font_02_sfnt_off00018acc.bin
c3ce2e092c695e5eca54e37f899f24ee488c06fe6fa06b2be670d7f3a241e685		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18ACC 10560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.