Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed229b242ee910d8…

MALICIOUS

PDF

87.2 KB Created: 2021-03-24 01:28:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4bcc9406a8558435733b967a17e3342f SHA-1: 1c340ed1afbc535e3fa289edde36f49facc6467b SHA-256: ed229b242ee910d8e69e5050a0c708dbd2b4b0155fb9b8307cc8fb96f3fc4309
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier with high confidence. It contains an embedded URL that likely leads to the download of a malicious second-stage payload. The document body, though heavily obfuscated, suggests a lure related to downloading a calculus PDF, which is a common tactic for phishing and malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=shanti+narayan+differential+calculus+pdf+download
    • https://cdn.sqhk.co/jisaside/PhaQYhd/38851274928.pdf
    • https://static.s123-cdn-static.com/uploads/4371265/normal_5fcbfe5ec31c4.pdf
    • https://static.s123-cdn-static.com/uploads/4467910/normal_5fc7292b35986.pdf
    • https://cdn.sqhk.co/novigigexuxo/Ovlijgg/56767495057.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9cbed6aa-8f73-4f68-a622-839d79721a75/nebefo.pdf
    • https://06e27459-8a58-4d01-a48e-f853eab966f6.filesusr.com/ugd/55f1a0_0ed4d468aa3442c69cf24db6c5b2baf4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/85f693a1-bc9b-4165-b93b-f10b4fa6d85a/free_lighthouse_plans.pdf
    • https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_6a72be12983d4a09a63fdfee5bc719b7.pdf?index=true
    • https://s3.amazonaws.com/tokit/diwumuxamixevito.pdf
    • http://kuwijiti.myartsonline.com/dewalt_miter_saw_12_inch_parts.pdf
    • https://s3.amazonaws.com/ditiruz/why_is_my_polaroid_tv_not_turning_on.pdf
    • https://uploads.strikinglycdn.com/files/23362f4f-4698-42ad-a074-53f0fc85f245/78019208003.pdf
    • https://s3.amazonaws.com/kelageketisefuv/jiduzemapusebozobigilati.pdf
    • https://s3.amazonaws.com/meludav/sesor.pdf
    • https://ecab545c-19d2-4654-b6ac-fb8b9749f5ba.filesusr.com/ugd/e5412a_e224e737618d4e3f8226efad0c8a9f90.pdf?index=true
    • https://89e5ed4a-33eb-42a6-b5f1-9fc07ea1e15b.filesusr.com/ugd/ff68bb_ab8d4c92d19c4c288ed5c12c0308104b.pdf?index=true
    • https://f19d2187-ce67-4d04-8798-eef694565169.filesusr.com/ugd/bd4746_3103a3cd758647b59723c703c014b369.pdf?index=true
    • http://kuzemepusiloj.onlinewebshop.net/78545758992.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff68.bin
1ee94497b9c26dfb3d6743c67dd031065f801cc5dd3b25a6e420ac62905c4cb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF68 5540 bytes
font_01_sfnt_off00011254.bin
20a1fe94fed46b885ae1550b87a4b0ab45b74d487f23646da2b3301bf4c060fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11254 11368 bytes
font_02_sfnt_off00013970.bin
4aa67ef7990f9f722a461ceecbd9944631fde5a7423c5b0b0849fe532563edfa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13970 16320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.