Malicious PDF — malware analysis report

Static analysis result for SHA-256 f21cf6a15efc4bc3…

MALICIOUS

PDF

75.1 KB Created: 2021-07-12 21:01:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-20
MD5: b22788bf738a2ee2c88c265f99fabe94 SHA-1: 4619e4daf8709b648e0d0072c5320b78b0dad66a SHA-256: f21cf6a15efc4bc3a22f7d4a3d93722d2e00de4479ea5ccde3da1ff9197d0164
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected by ClamAV as Pdf.Phishing.Trojan. The presence of embedded URLs, despite some being marked as benign, suggests an attempt to lure the user to malicious content or download further stages. The PDF structure and the wkhtmltopdf authoring application indicate a potential for exploiting PDF vulnerabilities.

Machine Learning

  • Nyx PDF Classifier clean score 0.2489

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/k6oGaauGqGM/square?utm_term=informed+consent+ethics+psychology PDF link annotation
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec81df12c1416d2f1ab00c/1626112479570/girinetepadomafo.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e76c5e24443c4019b278f5/1625779295047/baaghi_2016_full_movie_free_download_720p.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c80d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC80D 15532 bytes
SHA-256: 9119688d2687a41f3cd99c6ce27d777f53b8010a4c74325f52a44342e79fb324
font_01_sfnt_off0000efe9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFE9 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00010800.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10800 10968 bytes
SHA-256: fa9c0860c1a77065c9ad128d69bcc0a19af7aed00125d32a47ca0a54bc5b097f

Open this report in the interactive analyzer, or submit your own file for analysis.