Malicious PDF — malware analysis report

Static analysis result for SHA-256 1edf45d9d7249e09…

MALICIOUS

PDF

90.7 KB Created: 2021-05-25 03:15:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 34aa38f447ad280dbdfb51c545271efa SHA-1: 566aa1841d5d1f0da07b6921c9774d68fa810980 SHA-256: 1edf45d9d7249e09aeb1f97d8045a0ccd39526e82518466f8df8f24f9d6b366e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search result for a game download, likely intended to trick users into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. No scripts were extracted, but the presence of a suspicious URL and the overall classification point to a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=pokemon+blazed+glazed+complete+download PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4483851/normal_60289fd8605ba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368732/normal_60409ebe9b4dc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387921/normal_5ffe411fb2220.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vavejijitatofu/where_is_the_hook_in_links_awakening.pdfIn PDF document text
    • https://s3.amazonaws.com/pojikovewijeja/79593478895.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3bdebde1-1a1f-47fe-a7d8-ea2186249df0/how_to_bat_in_tape_ball_cricket.pdfIn PDF document text
    • https://s3.amazonaws.com/sewamos/what_is_included_in_the_4_for_4_at_wendys.pdfIn PDF document text
    • https://s3.amazonaws.com/kiguteperilodu/newton_s_laws_of_motion_vocabulary_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d374741-3561-4260-a2ed-0009d6b32c5c/a_young_doctors_notebook_book.pdfIn PDF document text
    • https://s3.amazonaws.com/gorajikunobixi/23688450978.pdfIn PDF document text
    • https://s3.amazonaws.com/gelawiweza/webunepisodasubanovu.pdfIn PDF document text
    • https://s3.amazonaws.com/lazolu/beautiful_boy_celine_dion.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a664d9fb-ccdc-4482-aa3d-d21401b44e6a/learn_basic_electrical_engineering_by_s_chand.pdfIn PDF document text
    • https://s3.amazonaws.com/wenobagupexekap/90375748265.pdfIn PDF document text
    • https://s3.amazonaws.com/fajonubinomeder/85670251217.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e46dc63b-4ae2-4e10-b310-09432a246102/kolenivikidus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24797e7e-79e7-4eea-8611-1254e4901f88/how_to_set_a_g-shock_casio_watch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/752b17bf-f6c8-4521-86d7-229b8826d71d/little_house_on_the_prairie_episodes_season_6.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9fb83589-d2b2-47a2-97b2-62049f934970/bopukavumevagomopuki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b738ad7b-fcb6-4564-80e4-37b80857d33c/amt_amc_2020_results.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d07371b3-1deb-4704-a3ca-da4cd85d3ab5/whats_the_difference_between_eastern_and_western_philosophy.pdfIn PDF document text
    • https://s3.amazonaws.com/serogajugomiji/97932006111.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000121f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121F7 5464 bytes
SHA-256: 22f0379cb2b7b7b393e9b5a0a2d8217aec203067e76d978adb6d3dad4e85591a
font_01_sfnt_off000134a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134A2 11412 bytes
SHA-256: 78e164503c82a853d14c809f5942743f6d6edce8e5652f5dd0348a227a73eea4

Open this report in the interactive analyzer, or submit your own file for analysis.