Malicious PDF — malware analysis report

Static analysis result for SHA-256 1402b618cadaa537…

MALICIOUS

PDF

83.3 KB Created: 2021-03-22 04:09:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a286eab0580f7b881744e9f173f5c6e SHA-1: 6db456971a79407c9d2f12639cd8db2b744de63c SHA-256: 1402b618cadaa537f3eb00aa00e5036c4f19ae342ad4e535a5d2010238cf206b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to 'hand signals of basketball game' to entice clicks on the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=hand+signals+of+basketball+game
    • https://cdn.sqhk.co/bigulikexupa/grhehfX/nafofematasikokibufefug.pdf
    • http://giwapozolaleg.mypressonline.com/faputet.pdf
    • http://jonipifenukiz.mygamesonline.org/baruzilub.pdf
    • https://static.s123-cdn-static.com/uploads/4381551/normal_5fee2eec9548c.pdf
    • https://cdn-cms.f-static.net/uploads/4452853/normal_6041e4719d341.pdf
    • https://cdn-cms.f-static.net/uploads/4401540/normal_6021158d8fd83.pdf
    • https://cdn.sqhk.co/famagafe/jjdyjgH/duracell_rechargeable_aa_batteries_with_charger.pdf
    • https://cdn.sqhk.co/pibegufuxova/6ij3jet/food_maker_beach_party.pdf
    • https://cdn.sqhk.co/jeporikate/sPifOie/zizorowipewafurutorififux.pdf
    • http://gamowenugeg.sportsontheweb.net/librecad_freecad_qcad.pdf
    • https://cdn-cms.f-static.net/uploads/4452381/normal_600d79bf28e50.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zenakezogutomu.onlinewebshop.net/bisipaje.pdf
    • http://xuxerutiwuv.onlinewebshop.net/84271970953.pdf
    • https://uploads.strikinglycdn.com/files/96c8f7c3-1350-43cf-aa15-9314244a0a27/29305266147.pdf
    • http://gogujigasad.onlinewebshop.net/gunujufuduponunakigupofo.pdf
    • https://uploads.strikinglycdn.com/files/6fbac9e4-9ec6-42cd-bd52-78db83935084/football_training_with_cones.pdf
    • http://zuxokoberibaw.atwebpages.com/nojatezexekemebi.pdf
    • https://uploads.strikinglycdn.com/files/58abab3d-5c98-4a71-8852-e1fd1884188d/identidades_trigonometricas_cocientes_definicion.pdf
    • https://uploads.strikinglycdn.com/files/ccba7b4c-eee2-4788-902a-3044aee46a41/bezelepituparini.pdf
    • http://naburonip.myartsonline.com/88149929302.pdf
    • https://uploads.strikinglycdn.com/files/e999afe4-fb4d-4081-918a-db0d31f66a2a/which_is_an_example_of_cooperative_federalism.pdf
    • https://uploads.strikinglycdn.com/files/715fbb47-2339-4457-ab85-214df989d233/breville_smart_oven_air_sale_price.pdf
    • http://xezaretidatoro.onlinewebshop.net/bodybuilding_workout_and_diet.pdf
    • https://uploads.strikinglycdn.com/files/f561edd6-6461-4d65-ae07-53c531f0936a/25646587449.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107e9.bin
288c415de537064818318c553608dda4dd37322201ef117d07f080122943fd04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107E9 5296 bytes
font_01_sfnt_off000119dd.bin
2c990875b70e8d746d8b1478353162e941e2e3e83e08a8e076b28a2e038fd509		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119DD 11012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.