Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0d7bd9736d79199…

MALICIOUS

PDF

76.2 KB Created: 2021-07-14 02:06:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 6b7b44adf8b2a11c2ba2bf84315609a7 SHA-1: d4d5b83bb0a99d610e153fe5aab07b0c5c8b611c SHA-256: f0d7bd9736d79199dbf52692f9c43f88c4f7030e2d25977fb0d359461fa38dbb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically indicating a phishing or trojan threat. The embedded URL, although labeled as benign in the provided context, is a common tactic for phishing lures. No scripts were extracted, but the presence of embedded URLs and the overall detection suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/4Ji06Fp1PxY/square?utm_term=comparative+and+superlative+english+exercises
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec9afb69d4b63361491667/1626118907475/92934874944.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e93c5992abcc18c4f7033a/1625898073192/all_the_barns_in_forza_horizon_4.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8c9da2e50bb5a73f10fb5/1625868762855/89224234077.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee0d53c27d1e40a5467d11/1626213715275/watch_home_alone_2_online.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60edada2881afe0f0ced563f/1626189218281/74493031761.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee07031f6a951228742f3e/1626212099516/sexegiwowidulivigoke.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e7ad6c69e16759cf734e94/1625795948552/maretoguxoxaxejupevepu.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e80b524aaab0286a8c6c50/1625819986939/vamojezukutedim.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edf8eacb43530604ab1032/1626208490663/aspiration_in_tagalog.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e92bdf2c5c2f6215c96150/1625893855687/meaning_of_horticulture_in_english.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ed9dd28d40d36f0083fa88/1626185170317/betrayal_at_house_on_the_hill_rulebook.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ed707864a4563c8f7d7a29/1626173560603/18158569044.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c783.bin
e8371a5f5e559a922247ee1176a966f470483d636d10cd54303586d6f85b6a0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC783 16444 bytes
font_01_sfnt_off0000f22b.bin
6d41b4785824a209fe253ae256c6364826f0c977cd968214f3539f0faa679ec0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF22B 11260 bytes
font_02_sfnt_off00010c40.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C40 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.