Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e8769ba27ff8eb0…

MALICIOUS

PDF

76.1 KB Created: 2021-03-23 09:23:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2aaf4b011241dbb5bf89fdfc3e8f9474 SHA-1: e299b785a2419996b9fdbf749a6984f2e8f7c8f9 SHA-256: 0e8769ba27ff8eb057c3c7a74a7284d2a76c3da8d9fed197f8bf028aa3e6dffe
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and is flagged by a machine learning classifier and ClamAV as malicious. The embedded URL 'https://vilenefex.ru/wix?keyword=gta+v+download+android+apk+and+obb+ev' suggests a phishing attempt related to game downloads. The document body, though heavily obfuscated, contains references to 'Gta v download android apk and obb ev' and metadata indicating it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=gta+v+download+android+apk+and+obb+ev
    • https://static.s123-cdn-static.com/uploads/4450418/normal_5fe5459098db8.pdf
    • http://taribada.22web.org/did_samantha_from_sex_and_the_city_have_cancer.pdf
    • https://static.s123-cdn-static.com/uploads/4368962/normal_5ffeb993de69b.pdf
    • https://cdn-cms.f-static.net/uploads/4480423/normal_6011bb20820ab.pdf
    • http://jedilinosur.mywebcommunity.org/dowapag.pdf
    • https://static.s123-cdn-static.com/uploads/4367305/normal_60021eaa734ec.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mofibukuzoke.rf.gd/xariza.pdf
    • https://uploads.strikinglycdn.com/files/c6eb8468-fcfe-4f9c-b53f-56704ba9e282/13905110399.pdf
    • https://uploads.strikinglycdn.com/files/c00bbc15-c341-42f7-977a-0967ddaa8b55/resumen_de_libro_un_grito_desesperado.pdf
    • http://gamutazuzores.epizy.com/mekixapumojomaw.pdf
    • https://uploads.strikinglycdn.com/files/a39ac645-0f3e-459e-a3b4-eed9f548d894/zizejaravuja.pdf
    • http://joxumokuri.epizy.com/paper_cutting_and_folding_questions.pdf
    • https://uploads.strikinglycdn.com/files/2507b8b7-031e-471c-96ff-bf32f04c4483/how_many_calories_in_a_cold_brew_with_caramel_and_whole_milk_from_dunkin.pdf
    • http://sorofakomefus.epizy.com/how_accurate_is_the_crown_season_2_episode_8.pdf
    • https://uploads.strikinglycdn.com/files/d8077abc-52c0-401b-9889-b80b968140f8/lawnboy_mower_bag.pdf
    • https://uploads.strikinglycdn.com/files/b0cf4a80-43b7-4e17-bd28-c02fccb76ea1/coleman_dual_fuel_lantern_model_number.pdf
    • https://uploads.strikinglycdn.com/files/ebdce7a6-f8a6-4246-981a-e196cb23c314/can_you_get_ecg_on_apple_watch_3.pdf
    • http://tuxefunuzire.atwebpages.com/a_political_theory_of_foreign_aid.pdf
    • https://uploads.strikinglycdn.com/files/3323747c-38ed-46f7-b087-4fbaf2ce1c0c/jatevagelumu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebf3.bin
2bbfa4c0cd3745c215260fd02266299af9061ea25e0a027c5d6ccef2546cdee1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBF3 5160 bytes
font_01_sfnt_off0000fda6.bin
3b12f713667215de80978e3bc6fc216d50c660464674ac6007e43bb6906b40b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDA6 11088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.