Malicious PDF — malware analysis report

Static analysis result for SHA-256 1829281203ec2342…

MALICIOUS

PDF

271.6 KB Created: 2021-03-22 00:16:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 96bff469453a43a38e148ebc090b2379 SHA-1: d9f0150cbe666e8de73c6adf5ecdc3ecacf5e4b2 SHA-256: 1829281203ec2342a816fdcaf7136dbdff6425734f9a2c0577a61a4ac40d3973
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating an advance-fee scam lure, combined with embedded URLs pointing to potentially malicious content. The ClamAV detection and ML classifier further support its malicious nature. The document's purpose appears to be tricking users into downloading further malware, likely through the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8629

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=transformers+earth+wars+mod+apk
    • https://bawoxuvebi.weebly.com/uploads/1/3/4/8/134886771/2066217.pdf
    • https://cdn.sqhk.co/kujusiru/mgjWhhc/41904495985.pdf
    • http://durebemidiges.getenjoyment.net/96841561910.pdf
    • http://gamuxiwami.getenjoyment.net/que_es_el_estado_de_derecho_en_chile_1973.pdf
    • https://zuwositoxo.weebly.com/uploads/1/3/5/3/135315809/3c9b840ab2f6b.pdf
    • https://cdn.sqhk.co/rexukewanej/jegiihc/vrchat_funny_moments_2020.pdf
    • https://taboloralo.weebly.com/uploads/1/3/2/7/132741194/07a2b24d0451bf.pdf
    • https://cdn.sqhk.co/toledexipez/gh2hajb/sutosam.pdf
    • https://cdn.sqhk.co/siripeka/IlicRig/lofabag.pdf
    • https://mepagalupotope.weebly.com/uploads/1/3/4/2/134265457/lamitovaxunat.pdf
    • http://salimom.mygamesonline.org/hindu_religious_books_free_download.pdf
    • https://cdn.sqhk.co/wevafofed/oifojeJ/ramiz.pdf
    • https://cdn.sqhk.co/felolavap/ezifdjb/67457482560.pdf
    • https://cdn.sqhk.co/pekotegafod/hge2ifx/arctic_wolf_3660_suite_review.pdf
    • https:///www.minecraft.net/helpLEARN
    • https:///www.minecraft.net/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mijovutotukedes.onlinewebshop.net/75434768204.pdf
    • http://jabejanaboz.atwebpages.com/71903661804.pdf
    • https://bf23b77b-49a9-4bef-a898-a03cfb94aefa.filesusr.com/ugd/134172_30b0a1a1aab942efbf40302dc3d35f9b.pdf?index=true
    • https://be9c8297-50e9-4ec8-be22-7cc4068ef96a.filesusr.com/ugd/fc3b0b_b02e0fc5a3454ddab2787280cd6d8701.pdf?index=true
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_817c287dfb9d42c4b5a0526ef766c2e0.pdf?index=true
    • https://e26976e3-f089-44cc-a2a6-54bcc6cae308.filesusr.com/ugd/0df15e_80e365bf1b794fa6baa132466b112288.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003af01.bin
fa72874b8c381873b432d3b5cea9ecddba20f04e8e1c9face7d560df1136061a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AF01 6588 bytes
font_01_sfnt_off0003bf4a.bin
717d2b2d959a0576b6125bc046b1de62e502fc1ecd86de926fcab07028735618		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3BF4A 3876 bytes
font_02_sfnt_off0003cd30.bin
52a036113c0aca646d295adf6ee60b3a7f565df47505311984621aad7323e164		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3CD30 5356 bytes
font_03_sfnt_off0003df42.bin
977d5b364eb14ed17297b5f3f5306473acce96ef9e8455a9f1b622f42a67ba01		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3DF42 1676 bytes
font_04_sfnt_off0003e7b4.bin
db6d7be1f6f7b88e844347078a86f5f6c1d65235936d2615da940603e216266d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E7B4 14616 bytes
font_05_sfnt_off0004167e.bin
ef0523361c525b30c1a4d7649c5f66dfad7a3e592b4a85ab67f1423dc5af8e94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4167E 16864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.