Malicious PDF — malware analysis report

Static analysis result for SHA-256 e481dd7d8f10d4d6…

MALICIOUS

PDF

75.7 KB Created: 2021-01-02 12:08:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 4cd85ebc757946ec49a3323c073d58aa SHA-1: 16a96b816275eddaa94df99dae37707bead4317e SHA-256: e481dd7d8f10d4d601d3f0b1d5ca7c40785086ab9b3b538b3b5cd5470393f84f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a malicious site for credential harvesting or further malware delivery. The document body, though heavily obfuscated, suggests a lure related to 'Hesi exit exam practice questions'. No scripts were extracted, but the presence of an external URI and the overall detection profile strongly suggest a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=hesi+exit+exam+practice+questions PDF link annotation
    • https://cdn.sqhk.co/bezupidokaz/ZjEdhf7/top_country_songs_of_the_90s_and_2000s.pdfIn PDF document text
    • https://cdn.sqhk.co/retirijozi/igdahZa/director_project_management_jobs_nyc.pdfIn PDF document text
    • https://cdn.sqhk.co/faruzikako/EjchffF/34554599178.pdfIn PDF document text
    • https://cdn.sqhk.co/xolilipedeko/HJhd6hi/dabigeguweximifo.pdfIn PDF document text
    • https://cdn.sqhk.co/sesijisova/OgghidB/catchmaster_fly_trap_label.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/xafaxotaful/journeys_4th_grade_reading_book_workbook.pdfIn PDF document text
    • https://s3.amazonaws.com/nowonovege/88313676028.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfa33e03-526e-4b9a-b965-ffba2db9c302/49047809584.pdfIn PDF document text
    • https://s3.amazonaws.com/bulolimepol/gutufijali.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d863a925-12e2-45a0-b88f-66e01650fa72/vunef.pdfIn PDF document text
    • https://s3.amazonaws.com/gusaledikugumo/what_is_an_example_of_continuity_theory.pdfIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/penujenuxopavimozuj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b95dafc-f4cd-42e2-8436-665293232cd2/music_video_editor_app_for_android.pdfIn PDF document text
    • https://s3.amazonaws.com/sigobija/75385914294.pdfIn PDF document text
    • https://s3.amazonaws.com/tojabixefova/roblox_fe_admin_script_pastebin_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de1bcbcb-54c5-41a6-86e4-d8e905c9d48b/pink_floyd_the_wall_1982_blu-ray.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bef86206-cd5d-4ed4-a683-c03f41ff1c7b/nusobelemawu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB45 5084 bytes
SHA-256: d7123764edec72af665f5b67bbb2e9395af181c4ee06f84e63a1fddee3c21c38
font_01_sfnt_off0000ec75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC75 11028 bytes
SHA-256: 238ab66fa63258fb8df2e4fda5c72a1690ad059451272741651dae87e4e99e26
font_02_sfnt_off000111c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111C2 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230

Open this report in the interactive analyzer, or submit your own file for analysis.