Malicious PDF — malware analysis report

Static analysis result for SHA-256 eebf330489e3e3ea…

MALICIOUS

PDF

164.7 KB Created: 2021-07-17 04:27:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: aec0db583654fdcce1cd70eb7a85682c SHA-1: b8eab80040151416ea3da241b009ab4820919f69 SHA-256: eebf330489e3e3ea8613aa01708cabd97b69777d8f5ce14f24c09bf1a01bbf4e
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as a PDF document with embedded URLs, and ClamAV has flagged it as a phishing trojan. The presence of external URIs and the ClamAV detection strongly suggest a malicious intent, likely related to phishing or malware distribution. No scripts were extracted, limiting further analysis of specific execution methods.

Machine Learning

  • Nyx PDF Classifier clean score 0.1728

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/um1bUVUAM38/square?utm_term=equations+a+little+magic+answers
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60f18218d1d8e65aae8a7ad9/1626440217071/american_dance_theater_founder.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec7da3ef188817f7e0d63e/1626111395679/the_pathless_ps5_review.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e773de4b2b7f268b96156a/1625781215028/pdf_cooling_tower.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60eccc1b0f4a722977fc7d7b/1626131483805/bexugupopapugewujelerel.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec858ebdd82073f6ff41c3/1626113422647/examples_of_outpatient_facilities.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00020436.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20436 16792 bytes
font_01_sfnt_off00021c47.bin
745ab7aa160ac82568b6f3259dcc492ebb11ec58ce0065c5d0f927f19a9e2c94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21C47 16552 bytes
font_02_sfnt_off00023387.bin
252308e8a49fff86ac2625203e4b04003cc6a824aa27029fad74ddee292ecabb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23387 22816 bytes
font_03_sfnt_off00026d1e.bin
3e0a7590cee518492f3507af762cde98fba4c842c9af7db014d508112cd662a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26D1E 10888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.