Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec9d1cf5066e4a28…

MALICIOUS

PDF

85.1 KB Created: 2021-07-15 17:31:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: 639090eb3d6d2f1d3065c6775dc10897 SHA-1: c2cfc5f79530a5663964ad1d1c5d74744fc90cc7 SHA-256: ec9d1cf5066e4a28778eb2281ded1523ad41805db8f19a42048ccff04fe6c698
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as phishing malware by ClamAV. It contains multiple embedded URLs, suggesting a phishing or malicious redirection attempt. Although no scripts were explicitly extracted, the nature of the detection and embedded URLs points towards a malicious intent, likely to lure the user to a compromised site or download further malicious content.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4158

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/pL_UGxDroB4/square?utm_term=another+word+for+preponderance PDF link annotation
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60efd15c39c5d52effb49f26/1626329436922/85260128137.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ec876a154eb17b684a63f2/1626113898893/ph_of_distilled_water_and_tap_water.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec8fd2f6fc466b5bf42f07/1626116051152/2nd_puc_business_studies_1st_chapter_notes.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e7824ed0c92d435c337dd7/1625784910903/damiredomuviwetilijenowit.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60efe7975d627c4551e16460/1626335127456/97818926957.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60effb45d052060b21f6a977/1626340165821/chow_time_buffet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c053.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC053 10476 bytes
SHA-256: 3bba8a88a912f1ced72d54b9a636094dc4b8d9a0065ff20aac5d3af9ff4bcd70
font_01_sfnt_off0000d82d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD82D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000f03e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF03E 16576 bytes
SHA-256: afa1da22216eebc1612a2aa383ebf1e25780f64845c7cc0172d52d44c362bc3d
font_03_sfnt_off00010776.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10776 20296 bytes
SHA-256: c43582bca45cec50fff6f6fcd8a1435887a40a368c9235edf2e1eed943ec893b
font_04_sfnt_off000139fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x139FD 2768 bytes
SHA-256: 064093da84925fd6276f9ea35b628c99df1868beeb566d04a7484969b864cd13

Open this report in the interactive analyzer, or submit your own file for analysis.