Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef2f6793c58e31b5…

MALICIOUS

PDF

90.9 KB Created: 2021-04-02 08:32:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58add861e1ff5bd0af1ff2b201bba73a SHA-1: 53ad28f2a9678359fab68d89117d6a3098b43ca8 SHA-256: ef2f6793c58e31b5f2049ff7e35fdcc7cf4da1de144a953b081a61f0bdd24fee
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though partially garbled, suggests a lure related to an 'ionic bonding worksheet', indicating a social engineering attempt to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=ionic+bonding+worksheet
    • http://kidufamipowanot.mywebcommunity.org/99690957939.pdf
    • http://bilet-pdd.site/17578805804n9d6l.pdf
    • http://leopards.space/kuxoxotezomupipogizpvba6.pdf
    • http://rfs.team/77053375479g1n9d.pdf
    • http://yildirimotobursa.com/microsoft_excel_deposit_slip_template6jgef.pdf
    • http://koteyarn.moscow/exercise_bike_screen_not_workingl1j7k.pdf
    • http://latencfsrt.space/rupexudogajuwikimn9dm.pdf
    • https://cdn.sqhk.co/wizokawoxo/xhijhji/lusunowiz.pdf
    • https://cdn.sqhk.co/sujubowip/H9Lhjjd/83152431258.pdf
    • http://dejenojowel.iblogger.org/saeco_espresso_machines_reviews.pdf
    • http://best-store.club/clubbers_guide_to_ibiza_summer_2000pb3ar.pdf
    • http://dajinanumiki.iblogger.org/former_spouse_meaning_in_telugu.pdf
    • http://www19216801.site/munewevamudetedolebiwa6ltfb.pdf
    • http://halfraire.xyz/virtual_blood_typing_labgjb52.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3064a0a7-8496-4b95-be1e-56094aee372f.filesusr.com/ugd/0cf4b9_436619c405c24adc881df52b4e60cc70.pdf?index=true
    • https://3df06c22-1e8a-4082-8cc2-a0fdc0609706.filesusr.com/ugd/d86e81_feaffd405a75472ea99c1b2a61bb4a4d.pdf?index=true
    • http://woxesizefibugel.atwebpages.com/stafford_loan_master_promissory_note.pdf
    • https://d0fd53c2-66a5-49f7-a942-a4bfc50892a3.filesusr.com/ugd/11baf9_a6fe7081e69e413dbaf490ad3b74b698.pdf?index=true
    • http://rifoxofome.rf.gd/62479140109.pdf
    • http://kozananagejeme.rf.gd/48124413077.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011380.bin
223aa70e53ee17308f0f8a750981bce3f4eae2bd43053c3e836f82c22a0dca1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11380 5192 bytes
font_01_sfnt_off00012538.bin
0977b2a05baf9d4cdebde87ad3d87b8ae8316f68d1673007ccf1cd92d89e7dab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12538 10644 bytes
font_02_sfnt_off000149b1.bin
e02a88d9599712d873514dbcec8653059ead18a1e44b795828ff7943e65f13a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x149B1 16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.