Malicious PDF — malware analysis report

Static analysis result for SHA-256 28827650de940408…

MALICIOUS

PDF

77.0 KB Created: 2021-03-28 08:23:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 757eff21be7e52f3838e3bc28757ffcd SHA-1: ee5304673c69f0df7725a9bd160fbae8a46eb0f6 SHA-256: 28827650de9404085de2190fa78154bcaa0fe3a3f267d56a5d0c8e8f2f25101d
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It impersonates a cloud document lure, attempting to trick users into downloading an Android application from the provided URL. The embedded URL points to a suspicious domain associated with malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=pokemon+platinum+apk+free+download+for+android PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4449181/normal_6025b322b06be.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365582/normal_5ff1b64ad35a3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451565/normal_600985e60e749.pdfIn PDF document text
    • http://rejorevubirobu.sportsontheweb.net/fifowupisotama.pdfIn PDF document text
    • https://cdn.sqhk.co/bedogipaxog/phjFhia/thoracentesis_and_paracentesis_difference.pdfIn PDF document text
    • https://tapidokebijimub.weebly.com/uploads/1/3/4/5/134577153/1614792.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4499341/normal_5fe1387d172f9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470221/normal_6011e7229307c.pdfIn PDF document text
    • http://nepoxiduvilej.scienceontheweb.net/sexamopexesexubamasukim.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417024/normal_6056d6834b919.pdfIn PDF document text
    • https://cdn.sqhk.co/minederepa/eZhhqST/57139948159.pdfIn PDF document text
    • https://cdn.sqhk.co/kifukuvitog/9geGxhj/18991262247.pdfIn PDF document text
    • http://deladinabixek.sportsontheweb.net/96268463986.pdfIn PDF document text
    • https://pejupatuwotim.weebly.com/uploads/1/3/2/8/132814375/8945265.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449974/normal_5fcaaf4541a2d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412593/normal_6047c8b3e4b2f.pdfIn PDF document text
    • https://cdn.sqhk.co/rureroso/Wjehibz/pc_simulator_games.pdfIn PDF document text
    • https://revegeworosopo.weebly.com/uploads/1/3/1/6/131637057/nifezetu-zakuwo-gagib.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://doxokalisawe.myartsonline.com/les_nergies_renouvelables_cours.pdfIn PDF document text
    • http://vikituluw.rf.gd/77507813024.pdfIn PDF document text
    • http://kasowaxakab.rf.gd/astm_a240.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0AA 5164 bytes
SHA-256: b2593666191347daea68bd580a755b69eac9f9c5dfc0f5e5b35ba3bd5a6ac9d2
font_01_sfnt_off00010241.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10241 10576 bytes
SHA-256: 29b2b6c0359583f052a9bca12787742a6094bfc344c64b5a0f66c3e42b5be2db

Open this report in the interactive analyzer, or submit your own file for analysis.