Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0bbbe19cca32519…

MALICIOUS

PDF

122.5 KB Created: 2021-05-02 06:16:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ae3e89364a6383226b269bf87686f8d3 SHA-1: 50f82da41fc805a8b612400ea20a9ac9ca58191d SHA-256: f0bbbe19cca32519a604d2d65e25b4830d598ea4e3b38298b1e2e2c3f7515667
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, one of which is directly referenced in the heuristic findings, suggesting a phishing or credential harvesting attempt. The document body, though partially corrupted, contains text that appears to be a lure related to educational materials, intended to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9889

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=glencoe+geometry+chapter+1-4+skills+practice+answers
    • http://filozajerezabi.getenjoyment.net/bienestar_social_concepto.pdf
    • http://123dutch.com/98083015321cj98b.pdf
    • http://service-hire.com/47087493563018dg.pdf
    • http://rubisteq.online/formal_business_apology_letter_formatuvve5.pdf
    • https://cdn.sqhk.co/lafixafif/5dhgdhe/terraria_super_sniper_rifle_vs_all_bosses.pdf
    • http://batut.space/jalunujepimugubifrb24x.pdf
    • http://stickerrus.ru/verbos_irregulares_en_espanol_ejercicios2ndlt.pdf
    • https://tawedituja.weebly.com/uploads/1/3/4/8/134864040/jonubimo-dagurinolunevin-fuxiwobi.pdf
    • http://ganitigusawev.mygamesonline.org/12777506405.pdf
    • https://cdn.sqhk.co/kewukapugino/bSK3cLW/kesejunekib.pdf
    • https://lopamazaveseku.weebly.com/uploads/1/3/4/6/134643240/kewazowuguw-torefafod-gexilakire.pdf
    • http://heretythere.site/app_store_apk_for_iphonefjo2j.pdf
    • https://sezorataxij.weebly.com/uploads/1/3/4/6/134600708/a742f60.pdf
    • http://cashbackk.site/revevemk7mr.pdf
    • http://shtangye.xyz/convert_unit_rates_worksheet_7th_gradeu1iqz.pdf
    • http://muzibatixabu.mypressonline.com/fijizolexanesepibemeb.pdf
    • https://kekufakaxuw.weebly.com/uploads/1/3/2/7/132740700/ramukilagaker-mejusudibem-ripironifesudaz-lororuk.pdf
    • http://zebozewazogaso.scienceontheweb.net/ch_3_science_class_9.pdf
    • http://sallely.xyz/colorado_ballot_initiatives_2018_guidectav9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://naranosufok.atwebpages.com/lapunugofedam.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000124a3.bin
38ee8f64727b55306fdf0b968471022ca9ff82779217f588e1f30ece364e930c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x124A3 6588 bytes
font_01_sfnt_off000134d5.bin
e08bddac5ff4b62959eab6e55b251f5b8fc1ddb2ee9cb1afe8f97e363b0a94b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134D5 4448 bytes
font_02_sfnt_off0001440d.bin
0dd52f78935c773d5188ffdcf61c9f7c9d852775ee16b9da65a189c38aa4ab03		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1440D 5808 bytes
font_03_sfnt_off0001579c.bin
04c72b3c61bebe16759b485730a590d7ea98ccf6407af818c4a91628215c071e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1579C 6232 bytes
font_04_sfnt_off000166c5.bin
498ccf9c738f4f95a564b67a6809da73abb75d2b464ecc48bff0fe7393769a43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166C5 18672 bytes
font_05_sfnt_off0001a331.bin
7214e6de89d878a540886df387f636b5177d0f56eee3cc85f4fe5664c0b02cc8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A331 17616 bytes
font_06_sfnt_off0001bdf1.bin
5131c7aed091007a039d986497f2bae818d05594cdc0bd7b8c7b779fe8e48b52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BDF1 3664 bytes
font_07_sfnt_off0001c97b.bin
e848208f48f703e0e2ae26a49592c355d57944d23230cbb1a6bdfaca2d46786a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C97B 6160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.