Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6ca9193b82b0672…

MALICIOUS

PDF

78.1 KB Created: 2021-07-14 00:39:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: a3c6e47eed0f1c3bad2b377a4dabff62 SHA-1: 9e8e50877db99b04978f70a8f95fc46d4c48a590 SHA-256: f6ca9193b82b06725f9dc93fd37a81eb605bde6e9e19bbcacfba11753e802049
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to trick the user into visiting a phishing site. No scripts were extracted, but the presence of an external URI is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/square?utm_term=6+year+old+tantrums+over+clothes
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ecd2dec6505401f35554c4/1626133214465/what_causes_orbs_in_photos.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e879ebeafd98094073887b/1625848299273/words_with_z_and_n_in_them.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec8bd0af807f1e1525fa9f/1626115024662/assassins_creed_4.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ee035f7979814f85ac199c/1626211167293/happy_thanksgiving_thankful_for_you.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e785b67ef31d0d76ee00ba/1625785782279/hungry_dragon_mod_apk_unlimited_money.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e9285d6e267257943b1bd8/1625892957563/answer_the_following_question_in_brief.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60edfed4c450ee473082a148/1626210005196/easy_history_questions_with_answers.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e7e7127d3b385c94b61964/1625810706468/internet_article_reference_example.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ed65fac76d6b0ba00d3a6f/1626170874519/97046165220.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ed6eaea17c7f1bf003ad37/1626173104708/zaradegexedutejukeg.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ee0490afeffb59e675fccf/1626211472900/6675982097.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ede5646f118478735cd003/1626203492843/another_word_for_conquer.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8c9da2e50bb5a73f10fb5/1625868762855/89224234077.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e7a91952059f1ec1e14975/1625794841234/red_headed_woodpecker_washington_state.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e778320907fb5468460b36/1625782322669/what_does_prospero_mean_in_english.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d209.bin
2fa86ebad8b8ff639cbcc20e766e4f059d1ef9b102b91249b90b008a268b3bb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD209 15712 bytes
font_01_sfnt_off0000fa82.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA82 16792 bytes
font_02_sfnt_off00011299.bin
4000f2ef098e98d2e4b3640653db20768a22731a0821ad49ea9226566938bb50		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11299 10896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.