Malicious PDF — malware analysis report

Static analysis result for SHA-256 08f67869f3129537…

MALICIOUS

PDF

84.0 KB Created: 2021-06-12 14:49:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7cecc67262962783d365121e07f07676 SHA-1: 05dba2137c97c267e50e8d1f90efb2325b7e67b6 SHA-256: 08f67869f3129537af424a89fe21a227133bd56249f6df809c3749fb116a3520
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a domain associated with malware distribution, specifically disguised as a game download. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware delivery. No scripts were extracted, but the presence of a suspicious URL and the overall classification point to a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/pbw?utm_term=age+of+empire+offline+apk
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pejokawigar.pbworks.com/f/minecraft_pocket_edition_2021_download.pdf
    • http://zoririlebo.pbworks.com/f/acer_aspire_5736z_webcam_driver.pdf
    • http://jevibufile.pbworks.com/f/21840836639.pdf
    • https://uploads.strikinglycdn.com/files/9e2654fe-89e8-459b-a25a-05919b66d0da/98447334843.pdf
    • https://uploads.strikinglycdn.com/files/43150bdb-dbed-4164-a4c6-1adc60b8a067/lorunakixuredupizi.pdf
    • https://uploads.strikinglycdn.com/files/db2a0f86-419e-44dd-a139-a864f1ad4412/45807823601.pdf
    • http://poforezufovu.pbworks.com/f/60148735429.pdf
    • http://kivotin.pbworks.com/f/dd_gunslinger_character_sheet.pdf
    • http://fixiguru.pbworks.com/w/file/fetch/144436497/95241803234.pdf
    • http://sodopateduke.pbworks.com/w/file/fetch/144606360/72956424172.pdf
    • http://bawamotijeku.pbworks.com/w/file/fetch/144449757/que_paso_ayer_2_banda_sonora.pdf
    • http://fafevupu.pbworks.com/w/file/fetch/145030680/wanitusuro.pdf
    • http://gafuxexosaru.pbworks.com/f/89799827371.pdf
    • https://uploads.strikinglycdn.com/files/15038dc2-fe89-4233-8b40-a71a034ca557/how_to_remove_bassinet_from_graco_pack_and_play.pdf
    • http://fujiserefi.pbworks.com/f/dukeboten.pdf
    • https://uploads.strikinglycdn.com/files/a0d9a293-8a99-4f50-9260-57aa84280e42/jam_chill_out_wireless_speaker_instructions.pdf
    • http://dokajawema.pbworks.com/f/cbse_7th_english_book.pdf
    • https://uploads.strikinglycdn.com/files/171db29b-c011-4571-9f1a-1122e6f4bb27/changan_automobile_annual_report_2016.pdf
    • http://werinenimuta.pbworks.com/w/file/fetch/144681258/ruh_saln_etkileyen_evresel_faktrler.pdf
    • https://uploads.strikinglycdn.com/files/bd1159a3-6cd5-4271-a760-b61bd8b5106b/how_many_watts_does_a_mini_freezer_use.pdf
    • http://suniger.pbworks.com/f/81653961546.pdf
    • https://uploads.strikinglycdn.com/files/0369f10e-52fb-40a6-8c1d-fb69f419d6dd/91160215809.pdf
    • https://uploads.strikinglycdn.com/files/addecd68-21cd-4cf0-9e68-17d7d20b1998/63929170290.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f257.bin
526c5a2175551476bef9e67e23fc16d118bda5f5d89964818a68e3a853678add		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF257 6476 bytes
font_01_sfnt_off0001025e.bin
064abacd5bc82c17393877223687edf2d4d6375d88e49cb78ecd594cbd0b35bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1025E 5096 bytes
font_02_sfnt_off000113aa.bin
eb66f48f3aaefe9b552bf015cb51f9aceff5d8f1f0d549fa2133047f07ba985a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113AA 16540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.