Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e8adb3919c8bf89…

MALICIOUS

PDF

80.9 KB Created: 2021-03-20 11:38:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50e0d3aecedad515b25b65d84c794edd SHA-1: aefec122d76014e4e96d085ae76fb635c7089e55 SHA-256: 0e8adb3919c8bf896883730b13ea20fa36cd55bbdaa929fb6a356dc233e432ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a phishing page or download further malware. The document body, though heavily obfuscated, suggests a lure related to 'undercover ops'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=undercover+ops+unblocked
    • https://cdn.sqhk.co/pimibopugugo/eJkOOic/fodadapadadusuloxisav.pdf
    • https://cdn-cms.f-static.net/uploads/4371020/normal_5fda89e180994.pdf
    • https://cdn-cms.f-static.net/uploads/4474752/normal_60415a445998b.pdf
    • https://static.s123-cdn-static.com/uploads/4482023/normal_60089e54a11c9.pdf
    • https://static.s123-cdn-static.com/uploads/4456985/normal_600488bdbe281.pdf
    • http://inmyshtangen.xyz/35456926621oc2on.pdf
    • https://cdn-cms.f-static.net/uploads/4402745/normal_600bf03aa0c5c.pdf
    • https://cdn.sqhk.co/fawabanof/LxN8gdv/rt_news_live_application.pdf
    • https://cdn.sqhk.co/nugizape/giibsBN/vemisemi.pdf
    • https://cdn.sqhk.co/zoxogatuv/icAZHYJ/newir.pdf
    • https://cdn.sqhk.co/tavolimogid/hihiLJh/samurai_swords_board_game_review.pdf
    • http://springwin.space/30814055797trjam.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8e476312-75a0-4ca3-b85f-82acf06e88bb/how_to_search_google_photos_by_face.pdf
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_ca422acfd9cb4aa2b434e575c5d59258.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b8831c3e-7eab-45c9-9b70-b5af398f2841/what_is_screening_in_psychology.pdf
    • https://s3.amazonaws.com/mefadedosuw/python_64_bit_3._7._3.pdf
    • https://3485775d-af35-4505-8fb4-f6750f575e04.filesusr.com/ugd/42f18e_a451f7e72ab541febb921322b85cf1d5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/31467fa0-954a-426c-978f-81080164b2f8/44748056926.pdf
    • https://s3.amazonaws.com/zarusegibitumet/medical_report_request_letter_template.pdf
    • https://uploads.strikinglycdn.com/files/1c4f2ac9-6aaa-4763-9746-bfbd6ba62de6/sumisaka.pdf
    • https://s3.amazonaws.com/ganubifirigevi/seiko_titanium_chronograph_100m_watch.pdf
    • https://uploads.strikinglycdn.com/files/54177572-8a6f-4bc1-a8dc-7e4941b3e50d/world_champs_lol_2019.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb1a.bin
d362430cf4e9c6e7d4fdb9643c14e4f401c56711ae91ef6de45842f245be74ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB1A 5112 bytes
font_01_sfnt_off0000fc91.bin
7db9ea10a222b5374acbfc47243e44f3bdd50a77f7d33f3ffc8ac5b63dfad1ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC91 10996 bytes
font_02_sfnt_off00012106.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12106 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.