Malicious PDF — malware analysis report

Static analysis result for SHA-256 04b181ec48f0c482…

MALICIOUS

PDF

673.3 KB Created: 2021-02-10 17:07:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 4f61299505bf1769857465c8285f6243 SHA-1: 5d0f4a92c71590343cd77e9476d7e79be52d1533 SHA-256: 04b181ec48f0c482b5f61cf4368e78014f15763e3e2e1bcfe4c47f65e7ef9b96
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs that point to suspicious domains, and ClamAV detection indicates it is a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to a video game achievement guide. The presence of external URIs and the ML classifier's flagging strongly suggest malicious intent, likely to redirect users to a phishing site or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5595

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/aws?utm_term=battlefleet+gothic+armada+2+achievement+guide PDF link annotation
    • https://pegufozexak.weebly.com/uploads/1/3/5/3/135317465/jekifup.pdfIn PDF document text
    • http://milanbeachs.space/viremabukonovogs552g.pdfIn PDF document text
    • http://reawolt.online/40706551168zidra.pdfIn PDF document text
    • http://cashthe.ru/minecraft_crazy_craft_3._0_mod_pack5ykut.pdfIn PDF document text
    • https://fenemonefozu.weebly.com/uploads/1/3/0/7/130739495/zaxunin.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455660/normal_5fd63255cf977.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393029/normal_5fce662427410.pdfIn PDF document text
    • https://jozokuxig.weebly.com/uploads/1/3/2/8/132814463/a00ccace7f.pdfIn PDF document text
    • http://stav-games.ru/zegimajx2xy3.pdfIn PDF document text
    • https://numibogag.weebly.com/uploads/1/3/4/3/134323011/808584.pdfIn PDF document text
    • http://zoomita.fun/android_discussion_forum_app_abulletinoa6t0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rovikibixu/51664819230.pdfIn PDF document text
    • https://s3.amazonaws.com/mokamoba/worthy_information_in_a_sentence.pdfIn PDF document text
    • https://s3.amazonaws.com/zosevid/cours_d_automatique_asservissement.pdfIn PDF document text
    • https://s3.amazonaws.com/dutimajizowa/82581587568.pdfIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/video_converter_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/vibuvomomuv/apple_music_premium_apk_hack.pdfIn PDF document text
    • https://s3.amazonaws.com/timituvupame/13807424290.pdfIn PDF document text
    • https://s3.amazonaws.com/novifamigot/38931715614.pdfIn PDF document text
    • https://s3.amazonaws.com/megujobemegor/teacher_evaluation_report_for_students.pdfIn PDF document text
    • https://s3.amazonaws.com/votawawo/97856011070.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0008c96d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C96D 102824 bytes
SHA-256: 31d8b088efb6e8ebee6f42c37663d5a8bbe74c9f3df9586da1bbb6b02d25f005
font_01_sfnt_off0009fe27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9FE27 5496 bytes
SHA-256: 90530e4cd48ffc367a9de98c81a4c842ebafd84d7e509e5c47b7336c17960be6
font_02_sfnt_off000a10c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA10C2 6600 bytes
SHA-256: af7dbf1923295c5aa30fb1894fa29fba02cce522d0a88e6ef8c1ae0d8fc2f600
font_03_sfnt_off000a276c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA276C 18464 bytes
SHA-256: 02433ed3590e275d441074dede6c8dcfc121b24b0737a88d1f1cbb65cb445e62
font_04_sfnt_off000a5b07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA5B07 16356 bytes
SHA-256: 7620e8962b6ad4be04e51bb8057075d5675cde062421c6c986e51f4492f76e43

Open this report in the interactive analyzer, or submit your own file for analysis.