Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed4f1899be1b4afe…

MALICIOUS

PDF

79.1 KB Created: 2021-07-21 11:42:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 69ae0535b8d17c410a50ec0a7d0f540b SHA-1: ce88535f2542fb25142f4500b27abc360924cef2 SHA-256: ed4f1899be1b4afeebd98bbf35f8907d1117fec2f5744e7a0e3985ee7de92863
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains an embedded URI pointing to a suspicious domain, crysiq.ru, which is likely used to host phishing content or a secondary payload. The PDF structure and embedded content suggest an attempt to disguise malicious activity, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/square?utm_term=how+to+pray+the+rosary+on+thursday
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f4f492c4d0d61e674b730b/1626666130708/86872923879.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f753bf562f1309bb2e95fd/1626821567850/nisupusufizilutixot.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60edd6d3ba7c7f743c1c6b03/1626199763229/pact_club_timer_iii_manual.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f32817a8f65e35b6d7683c/1626548247425/examples_of_health_related_fitness_and_skill_related_fitness.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f7337944cec5239bbb36e3/1626813305917/jejakarugaga.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f5efdec73e1a0ca88f01bb/1626730462245/common_english_words_used_in_daily_life_with_tamil_meaning.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f1e8bf6cc3a66bf95c5d09/1626466495988/71205804330.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec866cdd2ac847ff7edd74/1626113644808/asis_protection_of_assets_manual.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f11e48008c226a94251a8e/1626414664503/infant_not_pooping.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f7a208be79d63b81ec1b1f/1626841608294/61175634212.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e949d6320dbd0de28240da/1625901527094/wwe_2k19_on_android.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e915d1b68d8f0f4bf7c829/1625888209448/84864954371.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60eff5b891893d3c03952ed9/1626338744273/kibalowagixiwadudato.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e94d3d8ce0e10532d3f60b/1625902397209/xugigam.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f338c4bb7e64222df7687c/1626552516577/stimulus_check_august_2020.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d669.bin
c2b7eddf212bede6bc4d9b73bd9ea88ac04869af1459a5588568fdb334a70d27		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD669 15800 bytes
font_01_sfnt_off0000ff30.bin
58eb37c61b4647e220b223389897c3acb1d3ed5b35e036358529c0927b46f5d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF30 10644 bytes
font_02_sfnt_off00011793.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11793 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.