Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea7b91c10f6f6952…

MALICIOUS

PDF

392.4 KB Created: 2022-05-30 11:07:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2022-07-15
MD5: e5b9464e3c622eee882999101c5b7160 SHA-1: 353de4ed5da6450d767d6b1732033f4ac3a81277 SHA-256: ea7b91c10f6f6952d632a98fe2e512ce030a2e319ef0cb0a90db9a1444988655
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains an embedded URL pointing to a suspicious domain, identified by heuristics as a phishing attempt. ClamAV detection further confirms its malicious nature, classifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure for a worksheet download, aligning with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6398

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/XSRYdR1H?utm_term=dbt+wise+mind+worksheet+pdf+download+pdf
    • https://guxosenenizezov.weebly.com/uploads/1/3/4/5/134598055/xusipurebin_bogulisi.pdf
    • https://apsons.eu/files/file/41374424174.pdf
    • http://www.colormotion.cz/UserFiles/file/10991540141.pdf
    • https://bawusazatodopam.weebly.com/uploads/1/3/1/3/131378774/tovulodozuxobu.pdf
    • http://saadfanari.com/upload/files/91688712896.pdf
    • https://mikuloxituxawe.weebly.com/uploads/1/3/1/4/131410747/2051506.pdf
    • https://phatgiaolongan.com/upload/ckupload/files/59393817290.pdf
    • http://vasekurzy.cz/userfiles/file/zubilegosu.pdf
    • https://tubumafipe.weebly.com/uploads/1/3/4/4/134458357/tukosa_fifudiw_mabumixu.pdf
    • http://potolokomsk.ru/ckeditor/kcfinder/upload/files/86010853006.pdf
    • https://e3tam.com/assets/uploads/file/63535585394.pdf
    • https://degadita.weebly.com/uploads/1/3/5/9/135965793/bugaridojokadunu.pdf
    • https://zopuwisol.weebly.com/uploads/1/4/1/4/141457533/6230204.pdf
    • https://logosomuzabi.weebly.com/uploads/1/3/0/9/130969340/fesodotalaviwikupege.pdf
    • http://rracc.com/file_media/file_image/file/37392610626.pdf
    • https://tomosuboma.weebly.com/uploads/1/3/5/3/135382902/4b0adf.pdf
    • https://retibome.weebly.com/uploads/1/3/4/6/134680472/c70e48985.pdf
    • https://marotebage.weebly.com/uploads/1/3/4/7/134712984/501a841330699.pdf
    • http://journalstudiesanthropology.ro/adm/jsq/kcfinder/upload/files/vuzabixivowok.pdf
    • http://thetestmag.com/userfiles/files/26215009943.pdf
    • https://sefuzogesosemo.weebly.com/uploads/1/3/4/5/134579576/1cd3625e3.pdf
    • http://bubblesoflove.net/wp-content/plugins/formcraft/file-upload/server/content/files/16238b74a04c7c---murofinaguxuva.pdf
    • http://svm.kalistecom.org/img/files/96769470330.pdf
    • http://folientastaturen.pl/_data/file/50162111238.pdf
    • https://raauditing.com/userfiles/files/jezasokiwige.pdf
    • https://www.vyrobadps.eu/admin/kcfinder/upload/files/41420724579.pdf
    • https://triosms.com/userfiles/file/50036631394.pdf
    • http://poltinka.ru/userfiles/file/12996703820.pdf
    • https://aordonez.com/images/contenidos/files/8521215862.pdf
    • https://tefixokep.weebly.com/uploads/1/3/4/7/134715407/5533331.pdf
    • http://metisentry.net/ckfinder/userfiles/files/gikul.pdf
    • https://firowugulok.weebly.com/uploads/1/3/4/4/134484499/tuluj.pdf
    • https://xusiwalugu.weebly.com/uploads/1/4/1/3/141367361/a361e23db20.pdf
    • http://studioagronomoserragiotto.eu/userfiles/files/zogesubuta.pdf
    • https://lawatekuvux.weebly.com/uploads/1/3/4/2/134265731/3407354.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005b26d.bin
36a233c0656810163c374371586051a921b76a781dc2f84976089195005c4672		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B26D 11084 bytes
font_01_sfnt_off0005cbe1.bin
82deac1ed1c8a693c7acdb17e86524ece32fd8b8e02505dcf615a8e79a61793f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CBE1 17276 bytes
font_02_sfnt_off0005f912.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F912 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.