Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea383be6897859c1…

MALICIOUS

PDF

304.8 KB Created: 2021-07-22 00:54:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: c2bc52bd0fb33bb112954ef21565cd14 SHA-1: 89585b129aa04c4acf56918fdd536cd01e78ca1c SHA-256: ea383be6897859c1f9e7d5c7d30dd4b6961cf8a5ad6d6ded1afd1679813d9c38
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that points to a suspicious domain, which is a common tactic for phishing attacks. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9382

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/square?utm_term=the+absolute+value+function+is+one+to+one+while+the+greatest+integer+function+is+many+to+one
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f8907efec7cc27b4bebe22/1626902654839/35623215999.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8304769e16759cf790b94/1625829447282/vitupumiseputuma.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f43276d68f322590618f12/1626616438521/fasawipu.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e852b34a78a31cda99e164/1625838259252/king_lear_madness.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ee2ef5114e6b7b7de5f64c/1626222325969/wojog.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f59841616ef70f5bb0a3a0/1626708033282/papa_kehte_hain_movie_mp3_download.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f50f2b0b17490892229446/1626672939328/guxajebozub.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e921a3025aa46e30d2c8c5/1625891235192/carnage_captain_america.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f3ba2cbb7e64222dfce284/1626585644656/magnetic_field_at_the_centre_of_a_circular_coil_formula.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f170615142327a8744ab51/1626435682136/most_overbought_stocks.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f8954d4feb5b1dad2970e7/1626903885353/90336545161.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f7b35271a51f055543d9f5/1626846034464/44255769206.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f63811351e882d923fcd1c/1626748945949/46121198898.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f6f5d9fd91742e7df3c1c2/1626797529460/iconic_photos_of_the_20th_century.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f0a1340e564025fd722f18/1626382644863/2780591301.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f5eb08e539a422327eb8ec/1626729225093/82779657038.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f6bb7ec82ddf1a5391e563/1626782590685/jesus_went_to_hell_to_preach.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00040d9b.bin
2143becb2b3f5ea70e59aae9d9d44ff398825832203e51b86fdcc9d9b9d8e521		 pdf-font-stream PDF embedded font (sfnt) at offset 0x40D9B 11252 bytes
font_01_sfnt_off000427f2.bin
58bea7f4cece20edfcd70ae35497de6322c87a60e1e072422e4f84f48eca11dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x427F2 20464 bytes
font_02_sfnt_off00045dbb.bin
5ef7e20c43ec63259c23d22032bd2d0282148239607730cd8ddfa51a9511436a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45DBB 16240 bytes
font_03_sfnt_off00047393.bin
d715394c00fa85dd295175f1651015321be24be905317443908d1d79f6bc48c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47393 12056 bytes
font_04_sfnt_off00049a84.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49A84 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.