Malicious PDF — malware analysis report

Static analysis result for SHA-256 efeb2cf54dba8375…

MALICIOUS

PDF

76.4 KB Created: 2021-07-14 07:56:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 440d5be73151b5c5940e0eb144c52708 SHA-1: 77694cd7a2e23ced516defed665c73a4cd57ad2d SHA-256: efeb2cf54dba8375c522d51300643606a0d61fdec6ded9390c6ebd77c3082fb4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF was flagged by a machine learning classifier and ClamAV as malicious, indicating a phishing or trojan threat. The presence of embedded URLs, though many are marked as benign, suggests an attempt to redirect the user to malicious content. No scripts were extracted from this sample, but the PDF structure itself is suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9163

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/gOBB6uaVNRA/square?utm_term=can+you+eat+two+day+old+rice
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee06e4a9d1f62037e74c1a/1626212068840/meaning_of_brimming.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8f95db132fa3620718f23/1625880925716/kendall_jenner_now.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60eda45dc8312e4ee1df076d/1626186845903/lulenokibapojovajom.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ee4423537273346e302663/1626227747805/45958569140.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e8e63b66be7e490f0cb194/1625876027509/suzugononavi.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ee6d0b84a0477e84ae38f7/1626238219619/grays_clinical_photographic_dissector_of_the_human_body.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8fa9bf229ba2ea8358530/1625881243185/the_framing_of_the_us_constitution_word_search_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca99.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCA99 16792 bytes
font_01_sfnt_off0000e2b0.bin
62d5e9ea2c040f55a5c8d7388e088eb777234163db181dcaa8ecfa7a8c38ac76		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2B0 10528 bytes
font_02_sfnt_off0000fad7.bin
10875236b6621792e6c514c7e4a7d9928f36d51d82ff13865f34342f0c004222		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAD7 16508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.