Malicious PDF — malware analysis report

Static analysis result for SHA-256 f583580f6d1cce32…

MALICIOUS

PDF

86.4 KB Created: 2021-07-12 21:26:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 1b6a661651e170f585afefd12497152e SHA-1: 38ef8505e4fe1dfe2a0b8336352908f45c674760 SHA-256: f583580f6d1cce320a8ca0110e7084def14ef8e21220f409b987c49e34dfeb2e
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file was detected by ClamAV as Pdf.Phishing.Trojan, indicating a phishing or trojan payload delivered via PDF. The presence of embedded URLs, even if some are marked benign, suggests an attempt to redirect the user or download further malicious content. The PDF structure itself shows signs of manipulation with duplicate object bodies, which can be used to hide malicious code.

Machine Learning

  • Nyx PDF Classifier clean score 0.1542

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/gOBB6uaVNRA/square?utm_term=right+humerus+pain+icd+10
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e7cf47fdc75e32ab06fe91/1625804615436/15497895450.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e8cf7840fa0f2168471397/1625870200530/3183667183.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f378.bin
d99f8ebf835433dcd287e5220710d937a4ccbeb3c90979998cfa25fb57f99ba7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF378 15832 bytes
font_01_sfnt_off00011c60.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C60 16792 bytes
font_02_sfnt_off00013477.bin
57e3e89889e24ea44e191d7841432be6981b8e233aeaf628e1b8eaedd636273c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13477 11112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.