Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ab74bc20f8d09cb…

MALICIOUS

PDF

83.2 KB Created: 2021-05-18 09:20:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9f6d0f4f519bafe60a63025e85d39cc7 SHA-1: e4c61a9edf565a8047e8494a035aadd7aa3608d8 SHA-256: 0ab74bc20f8d09cb63e6597150b2876e33c52b2b9df92656fcdef1151ed24035
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that suggests a lure for downloading a game hack. The ML classifier and ClamAV detection strongly indicate maliciousness, classifying it as a phishing trojan. While no scripts were explicitly extracted, the presence of an external URI and the nature of the lure point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=offroad+outlaws+hack+apk+3.5.0
    • https://cdn-cms.f-static.net/uploads/4410000/normal_60246386aac3d.pdf
    • https://linonorimezolup.weebly.com/uploads/1/3/7/5/137519838/2108329.pdf
    • https://cdn-cms.f-static.net/uploads/4448551/normal_602bde34bbdac.pdf
    • https://vipukawolatu.weebly.com/uploads/1/3/4/4/134486161/5755272.pdf
    • https://cdn-cms.f-static.net/uploads/4444643/normal_6056374a3fd51.pdf
    • https://papukelub.weebly.com/uploads/1/3/4/6/134666119/kuxubakuvaref.pdf
    • https://xekuvezenigut.weebly.com/uploads/1/3/5/3/135346982/dafat-lojazuxugixif-tajegab-rararoxaful.pdf
    • https://static.s123-cdn-static.com/uploads/4454289/normal_5ffa7a8e08575.pdf
    • https://static.s123-cdn-static.com/uploads/4379038/normal_6002fdc3b8fd2.pdf
    • https://static.s123-cdn-static.com/uploads/4498994/normal_5fc7392d642ae.pdf
    • http://zufonirawanowo.iblogger.org/cengage_maths_book_for_iit.pdf
    • https://static.s123-cdn-static.com/uploads/4374700/normal_5ff417f4016bd.pdf
    • https://reponobokuwe.weebly.com/uploads/1/3/5/4/135401207/6d3622.pdf
    • https://telisawe.weebly.com/uploads/1/3/4/4/134466193/34e127ae.pdf
    • https://cdn-cms.f-static.net/uploads/4485942/normal_6061ca88b99d5.pdf
    • https://static.s123-cdn-static.com/uploads/4378599/normal_6009058c6c176.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mitefarosut.rf.gd/sisewudatonozodiz.pdf
    • http://pewuzakij.epizy.com/xufoninivejagodafozafip.pdf
    • https://uploads.strikinglycdn.com/files/189925de-c52a-4222-bb9e-f1779eaf6746/negeduxejo.pdf
    • http://jategemi.epizy.com/abdominal_compartment_syndrome_guidelines_2016.pdf
    • https://uploads.strikinglycdn.com/files/37f93fcb-160d-4dd1-9a80-352714e16c63/elements_of_music_terms_and_its_meaning.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eae2.bin
6f1a3710367bf509838e1ad670ab39d5801d853e8b7cd40300c031703cb82ae7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAE2 5888 bytes
font_01_sfnt_off0000ff03.bin
a3c66f931d9a248b6add24afe361a49f7bc9d52307ec8e2ce46a88c1984b0ae8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF03 12752 bytes
font_02_sfnt_off000128a6.bin
1572f1bef06e94643c552f70f3ef07ecee9bf7de88dacbdbabe2fa1db5c51cc3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128A6 16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.