Malicious PDF — malware analysis report

Static analysis result for SHA-256 f88043e4745b9a00…

MALICIOUS

PDF

86.1 KB Created: 2021-07-21 20:53:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 3c28c958a208f34856e74f518aed82fc SHA-1: 51c86b068edf34466b94472290e570860c80eab1 SHA-256: f88043e4745b9a0028a5bea498b08b2a321fba62eb788f14883baec19fc4a3f5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF that contains an embedded URL pointing to a suspicious domain, identified by heuristics as a potential phishing or malicious content delivery vector. ClamAV detection and ML classification strongly indicate malicious intent. The PDF structure itself does not contain readable content, suggesting it is primarily a container for the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/square?utm_term=inverse+fourier+table
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8f4635ebba154a8fa2877/1625879652356/spoilt_rotten_meaning.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f0717e40a5bc6c0f759506/1626370430950/luwizurunaralapudife.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ee550ffd66ff3739f00a82/1626232079935/77482370154.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f3a1bb1ad9bf1c32b7d8e4/1626579387979/a_field_is_in_the_shape_of_trapezium.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e937133f195e1e403705cf/1625896723249/92376194784.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f6d81612a73410a76e60b7/1626789910287/solution_manual_to_the_textbook_of_organic_chemistry_by_m_younas.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ee6caa6d75c50a5d46cea4/1626238122523/what_does_the_centriole_do_in_an_animal_cell.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f2146a0daf9c1dca127a33/1626477674615/lanis.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ee6efab1f8b9564888c627/1626238714732/71284924414.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec8032b6dedd3ae1686255/1626112051204/safewatch_3000_install_manual.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f07686be875f230107c384/1626371719144/meaning_of_swindling_in_english.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60eff2dd91893d3c03950fc6/1626338013474/microsectors_fang_3x_leveraged_etn.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ecac18f6fc466b5bf705e6/1626123288807/deviant_sexual_behavior_meaning.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e908a1c0906550d90a3fe1/1625884833668/37219658758.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee19fbb27e5958d58c9a28/1626216955369/marine_microbiology_books_free_download.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8d0cec158db2a32da8faa/1625870542561/agile_requirements_traceability.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f77983b5b7655d5a650db2/1626831235505/four_hundred_thousand_dollars_in_rupees.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f13b136e32095df98487b0/1626422035882/gikigagapage.pdf
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec80940cf33f708d7a0d37/1626112149067/lazaro_meaning_in_bible.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60eca241e7718717d764d26f/1626120769420/projection_of_points.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f25a159c57c2493931b627/1626495509583/49791698557.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eca2.bin
c2bc1a200a7cf00ff2980a1527eee2cfc5b325d68ad2dbfa3c74203778e8325c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECA2 10464 bytes
font_01_sfnt_off0001048c.bin
d507f823bb8cce5de1ef18d52d1673a6fafdeaa2660c0dd50028a73e463ccb0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1048C 17520 bytes
font_02_sfnt_off000132f5.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132F5 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.