Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef6e64202b1a45b2…

MALICIOUS

PDF

80.3 KB Created: 2021-07-24 00:34:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: d8e5eb72ac91b1783ca589489eea500c SHA-1: 5c19c640e4b06b2a5ad7980503c6e2c49c1e5a32 SHA-256: ef6e64202b1a45b21e0d55636d5e4a7fe531b28f188ad1b27c189d45da142cab
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'philabc.ru', which is likely used to host a phishing page or download a secondary payload. The document body is heavily obfuscated, but the presence of the external URI and the ML/ClamAV detections strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/square?utm_term=finding+nemo+full+movie+in+tamil+download+hd
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f9d67907b4d54a18c1a245/1626986105349/18374365364.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f9bdc10811da76fc7cc6b6/1626979777610/pisosinugiv.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e8f1da3f195e1e40343d8b/1625879002997/molal_depression_constant_of_water_is_1.86.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f5b97881b1ac12009e5826/1626716536757/fepoxadebuve.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ede2c380caa629c1dc9d4f/1626202819539/10452521239.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f2bf841d350707421802c7/1626521476381/5_letter_words_with_w.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60fb2eccb3a3333788bc7a8a/1627074252465/84824664209.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60faa082d6e5825ac4e31c0e/1627037827062/selection_in_hrm.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f33af451c2e860984eca15/1626553076276/dust_to_dust_the_carbon_cycle_answers.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f268d5bb7e64222deef196/1626499285376/is_agreeance_a_word.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f5f9eb13aa690191c8e2fd/1626733035696/58778881204.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f0215534da7a51e3f5632d/1626349909672/xamavaviz.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f6375c18f24d24f449e792/1626748765071/1556626561.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f7b8fcf307916d7de196a7/1626847484821/todays_daily_wordscapes_puzzle.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60eca43f3631fd4ab819627a/1626121279517/responsorial_psalm_for_catholic_funeral_mass.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60eddb18ad58ca03d2267eaf/1626200857075/tarotenutadugozirovo.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f8a86eefd43c45de6d989b/1626908782234/29657106142.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ee40dcdb6052518ec6c813/1626226909093/29039484522.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7ce.bin
90a731da657558629f3a1f816e97b8f11398693a801c35fcd5734040a08bef6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7CE 10764 bytes
font_01_sfnt_off0000f028.bin
90d5c3729f3f1f0e752f82e46e960a89d374f4670c2c8941dae70bcb69e1116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF028 16792 bytes
font_02_sfnt_off00011bf9.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BF9 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.