Malicious PDF — malware analysis report

Static analysis result for SHA-256 edf82949259ca549…

MALICIOUS

PDF

86.1 KB Created: 2021-03-20 00:20:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f68ddda1c9255f2c460098863179c60 SHA-1: 1caed610c73c02ed9f3f23cfd11839f5ca525775 SHA-256: edf82949259ca54980266957dfdb82e3ce0ac7c67b5cb49503d489fc2fc5cfb7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to 'greetings in English for children'. The presence of embedded URLs and the overall detection by security tools indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=saludos+en+ingles+para+ni%25C3%25B1os
    • http://kinoxca.xyz/nocturama_annie_baker_monologue91ld0.pdf
    • https://cdn.sqhk.co/rozesivotix/hgjdia0/13_colonies_projects_for_middle_school.pdf
    • https://cdn.sqhk.co/zumufapofow/jjbSihd/idle_tap_racing_mod_apk_unlimited_money.pdf
    • https://cdn.sqhk.co/rujiwujik/8I0jbgg/mahadev_video_status_download_hd.pdf
    • http://tederurokeroga.iblogger.org/ruwapajazamovajasedak.pdf
    • http://zakababonedip.iblogger.org/area_parallelogram_worksheet_tes.pdf
    • https://cdn.sqhk.co/subesanodag/1igVJgi/fukomadusobemoxak.pdf
    • https://cdn.sqhk.co/redexisa/g0hbhbS/servsafe_manager_certification_cost.pdf
    • http://ruwulazitu.iblogger.org/international_standard_email_address_format.pdf
    • https://cdn-cms.f-static.net/uploads/4481275/normal_6025216352ff0.pdf
    • http://creditreportfast.info/easy_knots_for_fishing39tb9.pdf
    • https://cdn-cms.f-static.net/uploads/4371788/normal_600faa78d9815.pdf
    • http://getyourscore.info/bimoxadamauzc5w.pdf
    • https://static.s123-cdn-static.com/uploads/4496391/normal_5fe346ca03133.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/feseni/the_secret_life_of_pets_2_full_movie_in_hindi_online.pdf
    • http://farilofisimoru.rf.gd/windows_10_enterprise_1803_esd.pdf
    • http://xefobimulekojuw.epizy.com/73558946237.pdf
    • http://tolejax.epizy.com/xawumuvupumexetebamed.pdf
    • http://rawobebisef.epizy.com/buku_belajar_bahasa_jepang.pdf
    • http://ruleruz.epizy.com/xaketo.pdf
    • http://mogadaf.epizy.com/16400311798.pdf
    • http://kulolepan.rf.gd/autoradiography_book.pdf
    • https://s3.amazonaws.com/baxunaf/97405335432.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101b1.bin
cd111695fdf6e1e44df46f5afa38079f6b0bbc4a18f92e2781d5ea525be1d3de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101B1 5244 bytes
font_01_sfnt_off0001133a.bin
3df652809cf5344c656febc115e48fd77c8fe75de6922eb50a81eb766c79ee00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1133A 12412 bytes
font_02_sfnt_off00013a91.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A91 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.