Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7a350ce5ca95383…

MALICIOUS

PDF

74.4 KB Created: 2021-07-15 09:36:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 3b32181d434ef6eb31070f893c508458 SHA-1: 12436d2c629c7ff86c20fe5e2402aa3d477e7c18 SHA-256: e7a350ce5ca9538361042c3c394096d78f20adfe5bb2066efcf7fb3753fc7006
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains an embedded URI that points to a suspicious URL, which is a common tactic for phishing or malware distribution. The ClamAV detection further confirms its malicious nature, identifying it as Pdf.Phishing.Trojan. While no scripts were directly extracted, the presence of an embedded URI suggests an attempt to redirect the user to a malicious site, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier clean score 0.1751

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/UZrB20b2Dcg/square?utm_term=upper+and+lower+limb+dermatomes
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee3a86462f394a1e41f85e/1626225286628/xenupol.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c215.bin
d2b2e360974e7e716683efca6d95ee70d0b477326012260c9a7d75f3e1f82f46		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC215 16584 bytes
font_01_sfnt_off0000ed47.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED47 16792 bytes
font_02_sfnt_off0001055e.bin
c4871cc1f6f13155d08e127d934d7cce0809537e5f34885dffd3e40ba8a13208		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1055E 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.