Malicious PDF — malware analysis report

Static analysis result for SHA-256 f63747fe2d883aa6…

MALICIOUS

PDF

73.8 KB Created: 2021-04-05 02:27:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5bc8c50eee4fe00c7651883b6df9f46d SHA-1: dbf448033d9ad477f76b7d078a67f52ce1b0eb91 SHA-256: f63747fe2d883aa65979d38c05e284534af7e14a8524ec9fc3f3b148c2736177
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is flagged as suspicious. The document body, though heavily obfuscated, appears to be related to academic exercises, suggesting a lure to trick users into clicking the malicious link. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=0+1st+2nd+3rd+conditional+exercises+pdf
    • https://cdn.sqhk.co/sigidezok/ggdifha/91741328748.pdf
    • http://reduslim-shop.site/tasuwugopagatamoxzujp6.pdf
    • http://helplnstagramcontact6088758.com/686186467250q4gk.pdf
    • http://verification-help.com/diagrama_de_clases_online_freenqgnj.pdf
    • http://busurman.space/avg_antivirus_pro_20198a2en.pdf
    • http://detonic-buy.website/42553787154ev6dw.pdf
    • https://cdn.sqhk.co/wowebajix/jaDhfja/oxygen_concentrator_amazon._de.pdf
    • https://static.s123-cdn-static.com/uploads/4445125/normal_5fcfaf9e36d6d.pdf
    • https://static.s123-cdn-static.com/uploads/4374196/normal_5fcddd4aaecdc.pdf
    • https://cdn.sqhk.co/nawakema/EFgdXBC/ricky_zoomtm_welcome_to_wheelford.pdf
    • http://redpandarecycling.com/how_to_draw_a_cat_easy_and_cutej9ya7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f265ac6b-bda2-4e35-a246-abc61219b115/6939650836.pdf
    • https://uploads.strikinglycdn.com/files/64e3575b-ea5f-4e39-991a-bc90838e2e17/73953235598.pdf
    • https://535f918c-e50e-4760-9dbe-4b22a9cc1357.filesusr.com/ugd/65883d_ad0d98f106f34c40a5c9754dfafd9857.pdf?index=true
    • https://00f02ae0-031c-4cf4-85c3-86bbc6d7deb2.filesusr.com/ugd/13f2e4_26cd1e45dc374363b8d71caa44d492e1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/37cea682-63f2-40f0-b877-c239997569d8/eaton_fuller_18_speed_transmission_oil_cooler.pdf
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_a39e0d9bd5a843a79d22197f4827b29f.pdf?index=true
    • https://c72a6d71-2fad-4f5a-8b7a-a7c165485bce.filesusr.com/ugd/a4966f_9c14e062c65f4e13802c3e6985c62b6c.pdf?index=true
    • https://d5aacb37-8766-4234-9cc8-c2ec3b911aba.filesusr.com/ugd/1e723b_26769f234c3143ba81dc403851c904db.pdf?index=true
    • https://uploads.strikinglycdn.com/files/39a63273-49a3-4b4e-97ed-b9b456f26efc/75566866685.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1bf.bin
e9e6d9f32da8b978b5f2bb821072bbce57ef51663e056eb755b492c1710ce2b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1BF 5612 bytes
font_01_sfnt_off0000f4f0.bin
7835a2a37ae9b3d2142bd0bee4b2b5167a51de6a733d524d03597f92127b37c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4F0 10920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.