Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa6c967bb6dd09c7…

MALICIOUS

PDF

86.7 KB Created: 2021-07-24 00:20:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 5dabc8d78fb8d780ab78372d559c0e6d SHA-1: 4c7e16e3d4ff39728e80179b53fc6c5906adf349 SHA-256: fa6c967bb6dd09c7ab5183f7d82c46693f05a254aeb08c74741b9ee9348e0a51
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely a phishing lure. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect users to a malicious site, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/square?utm_term=finding+the+rational+zeros+of+a+polynomial+worksheet
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f9c8d6fa3002450d67a8a5/1626982614917/jorixigigopojup.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f6c9b05aef3116e387d32b/1626786224287/naruto_shippuden_ultimate_ninja_5_ps2_iso_highly_compressed.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f5bd731899af0e469dfd53/1626717555441/irrespective_meaning_in_english.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e80fd85eabb22f35dcb56a/1625821144745/67452592400.pdf
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ecac34e0914637f38ee43c/1626123316112/treatment_for_mg.pdf
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f265e4de9f7d6ab7b231b5/1626498532521/ending_therapy_transference.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f9f6c81fd7b13c6dbb2090/1626994376873/29534729717.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e81090ce8457037ee4ab7e/1625821328490/55817875774.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f52692ec5ad00cc0a5b1da/1626678930136/39842869995.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f0377f1b42e761db8b4110/1626355583427/valikemo.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f0cf7b96ce9b33d72bee2b/1626394491327/all_cod_zombie_maps_in_order.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60fb2e4c514b4f2ec2a94711/1627074124258/4326780257.pdf
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60efe7425740a719f4ab15f0/1626335042392/red_green_colour_blindness_is.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f23b4f9dfa584dc9d3cc99/1626487631766/67629847785.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f063bb56d57e6ac3d2dca6/1626366907812/10009383392.pdf
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60fac9657c0f07413a97e6e3/1627048293960/76967813445.pdf
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8d868644c9b4de7f336e2/1625872489019/oncology_in_clinical_practice.pdf
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f2879dfb6d8f5e804fe96d/1626507165182/electric_field_due_to_arc_of_charge.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f4a688deec5816203e3f36/1626646152377/angles_in_polygons_worksheet.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f033016611482e0a9348bb/1626354433552/naxogimebigij.pdf
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e7e08e25441e1b37862cb3/1625809038581/sevabamozuketemepi.pdf
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f419a027519501fc19302a/1626610080423/vuwapeviwif.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7ce.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7CE 16792 bytes
font_01_sfnt_off0000ffe5.bin
25d412b7fb9d5ec51c2bffa0353999d165fbc0471bd1cab31756f4d54ba13bad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFE5 11276 bytes
font_02_sfnt_off00011a04.bin
41368998642937ee279f588e3512c3cd8f354d68b143f21426d9cfce2eb23947		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A04 19092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.