Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ccf17fc597930d8…

MALICIOUS

PDF

78.4 KB Created: 2021-06-05 22:02:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ed469b6fab4fababad536a7f6af7dc9b SHA-1: daaae95899acae88557b2eee8c4cb09490fbcfa9 SHA-256: 0ccf17fc597930d8e93a4618728c5d022ce2400f83a01148d15e0fd9ec88a408
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a domain associated with phishing, and the document body, though heavily obfuscated, contains text related to 'Citra 3ds emulator for android 2019', suggesting a lure for users seeking this software. The presence of PDF_URI and EMBEDDED_URL heuristics further supports the phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=citra+3ds+emulator+for+android+2019
    • https://cdn-cms.f-static.net/uploads/4401692/normal_60406483971f0.pdf
    • https://jazedase.weebly.com/uploads/1/3/3/9/133997310/2595830.pdf
    • https://xasavogo.weebly.com/uploads/1/3/1/8/131856096/8524250.pdf
    • https://static.s123-cdn-static.com/uploads/4366327/normal_5ff788a1466d3.pdf
    • https://cdn-cms.f-static.net/uploads/4471945/normal_602be1b16cdfd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a163078e-e3a9-4657-afbb-6a675326e04e/dr_martin_luther_king_jr_letter_from_birmingham_jail.pdf
    • http://togiwuvoze.pbworks.com/f/how_to_set_up_hotspot_on_hp_computer_windows_10.pdf
    • http://jizakatum.pbworks.com/f/91688065460.pdf
    • http://kipizasuzeda.pbworks.com/f/59991445059.pdf
    • http://xovelezid.pbworks.com/w/file/fetch/144656238/ficha_tecnica_de_raven_escala_general.pdf
    • https://uploads.strikinglycdn.com/files/82cf7fe3-4773-4a1f-90b2-fb63b33335e1/xutisibafo.pdf
    • http://mijatonevu.pbworks.com/f/gta_4_trke_yama_full_indir_gezginler.pdf
    • https://uploads.strikinglycdn.com/files/4ac3af54-f88d-47ca-a152-9e435f590248/75246153475.pdf
    • http://xosufixemuf.pbworks.com/f/viwulo.pdf
    • http://xesimisejek.pbworks.com/f/narrative_writing_example_5th_grade.pdf
    • http://kipizasuzeda.pbworks.com/f/sunilituro.pdf
    • https://uploads.strikinglycdn.com/files/4188123c-83f6-40ae-8912-b01fca448f71/saxeritegimufarexukobo.pdf
    • https://uploads.strikinglycdn.com/files/71e11e43-1c94-407d-beac-2530fbab5d5b/what_do_i_do_if_my_roku_remote_doesnt_work.pdf
    • http://foziwedugumu.pbworks.com/f/65268786817.pdf
    • https://uploads.strikinglycdn.com/files/e3c80c5d-00b3-48de-b9e1-15e28e6d47af/vijusexijezinuwikugewuk.pdf
    • https://uploads.strikinglycdn.com/files/104348af-b704-445d-8274-bbefa1464cf3/21970827971.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f210.bin
76dd424765160f89d64501db3d7ec1dc16739e73bd9060935df0989c03602621		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF210 5604 bytes
font_01_sfnt_off000104ff.bin
86611e2200a1b1b74d590696f199c8ee6ccdfc7beebf7a944291044aa2c1d875		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104FF 11748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.