Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb0318bd1db408a1…

MALICIOUS

PDF

101.8 KB Created: 2021-03-20 04:18:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f2d86f017b47176e4abac3bde38bef5 SHA-1: cd5bd312a61964523139f2898926c4b69ac3166a SHA-256: eb0318bd1db408a17755f9adf8f06784dcda92030046bf8e490fc82dcea0bf58
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a website disguised as a quiz answer key, which is a common phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution. No scripts were extracted, but the presence of a suspicious URL and the document's deceptive content are strong indicators of a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=trade+terms+quiz+answer+key+core+curriculum
    • https://cdn-cms.f-static.net/uploads/4425511/normal_5fe963e90eb48.pdf
    • http://torevifij.iblogger.org/wasalujawem.pdf
    • https://static.s123-cdn-static.com/uploads/4446270/normal_6000d704a161f.pdf
    • http://antinomi.design/asus_xonar_dgx_vs_se8w0o9.pdf
    • https://static.s123-cdn-static.com/uploads/4408599/normal_5fe31219d7abc.pdf
    • http://paypallsecurity.com/zokifuz8vl6.pdf
    • https://cdn-cms.f-static.net/uploads/4476127/normal_6036c35dcec9d.pdf
    • https://static.s123-cdn-static.com/uploads/4456143/normal_5fc8b27f323cf.pdf
    • https://cdn-cms.f-static.net/uploads/4408195/normal_60282c0ded302.pdf
    • http://paxazesak.iblogger.org/23002821790.pdf
    • https://cdn-cms.f-static.net/uploads/4469860/normal_601df5d7b2f6a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fapujeg.epizy.com/gutumitetafedegekixeputot.pdf
    • http://tujefozumuresul.epizy.com/heavy_rain_trophy_guide_walkthrough.pdf
    • http://laxiruzeremifam.rf.gd/ielts_speaking_part_2_questions_and_answers_top_50.pdf
    • http://pevurevakube.rf.gd/bleacher_report_wwe_backlash.pdf
    • http://kutubuge.rf.gd/antonyms_exercises_for_class_5.pdf
    • http://pugatexekar.rf.gd/ambient_weather_ws-_3000-_x5_manual.pdf
    • https://c6926203-1eb9-401e-9afa-11f61f201807.filesusr.com/ugd/685707_1068037e1ee2418f80346af8aa2e2327.pdf?index=true
    • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_c8497dcfb0f9466389a04f7508a09e53.pdf?index=true
    • http://debumiputun.rf.gd/40412165968.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000138a7.bin
6c36ccf2b429da0d587631483809fdd29ac863617047f1f801faaa1a0d8cfe15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x138A7 5468 bytes
font_01_sfnt_off00014b49.bin
0573aa7598fc93be6c95b9972ebe422bc1d756ccba6b4faad0809b5016c7f8ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B49 12136 bytes
font_02_sfnt_off000174bd.bin
99ddc6f5858eb134f8024171ebe717cbd02485c31471b921a5021903b5272953		 pdf-font-stream PDF embedded font (sfnt) at offset 0x174BD 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.