Malicious PDF — malware analysis report

Static analysis result for SHA-256 ece429955510b403…

MALICIOUS

PDF

80.5 KB Created: 2021-07-22 07:20:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: a8666bea9ba5977258e664eaedeec3ab SHA-1: e89c5d93c33202439c7e2ea7e2507dded9226410 SHA-256: ece429955510b40374a360f1cf6e08474084baee29e40768cffff54f0fb01abd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI and embedded URLs suggests it may be used for phishing or to redirect the user to a malicious site. Although no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious document designed to exploit users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/-7-cX3opz_8/square?utm_term=can+mice+climb+up+drain+pipes
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f8db30a663f73b0a59ac98/1626921776757/personality_style_disc.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f8268ac706697fb8b54286/1626875530272/kilukatejife.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f2f27c6c177f33d79daaef/1626534524996/46911934716.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e769c2815bc24aaf152111/1625778626311/pekuse.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f0ebb2ff43f805444f1277/1626401714766/pixisuwoxikitevukixakigem.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f5db2edfcc664ab1d4afc6/1626725166969/midpoint_formula_to_find_endpoint.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ed630e02ab3a569c438fda/1626170127114/32519528092.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f4ce776d5e991e36f19079/1626656375712/90828745785.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f8cafda4da41491ecdb84c/1626917629932/zufosuk.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e7b8ec95719b356d91154a/1625798893101/shadrach_meshach_and_abednego_and_daniel.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f3c811db752c5e49b07265/1626589201520/temomanuzudemoluwexawiva.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ed52d436a7a57c1cf1c395/1626165972770/bee_tv_download_android.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f368829471b562af12199a/1626564738146/top_4_player_games.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f4566027519501fc1bd508/1626625632624/washing_your_hair_everyday.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e93f0fe51f1f218d6aefd5/1625898767793/luzuxebinudoneroxefad.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ed9ce6262c1d40113473d7/1626184934723/tobujuzuta.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f4fb9c1d3507074232b1d9/1626667932534/letirarujusufuwofasep.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f3b268d9389f5e80921d8e/1626583656917/microsoft_excel_check_register_template.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8c487d7702a4b9a6f51fe/1625867399939/bojezemix.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f20c6a25d89e3fcfa96c3e/1626475627065/40285838445.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d970.bin
cc1a0cefca9562260c3116db66f28cf334db83862db57d0bc0277b92f37cec6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD970 10728 bytes
font_01_sfnt_off0000f1c2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1C2 16792 bytes
font_02_sfnt_off000109d4.bin
d78c097ace972164d63393424710c544fe7c0ba1527e14fe5e72a125ae56e34c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109D4 16560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.