Malicious PDF — malware analysis report

Static analysis result for SHA-256 346f95bc4c674519…

MALICIOUS

PDF

66.2 KB Created: 2021-03-17 09:24:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5cad63188676d38d6e70a6f57826efb6 SHA-1: 58f4ca80bdaa0818650666606a599cff76e0b969 SHA-256: 346f95bc4c6745199806c79a13be8cefbbd5664cf7185432d17dc4edf109ef9c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically flagged as Pdf.Phishing.Trojan. The embedded URL and document body suggest a lure related to 'minecraft pe 15.0 apk', indicating a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=minecraft+pe+15.0+apk
    • http://naturaitalia.space/reformas_borbonicas_cchtqsq9.pdf
    • https://cdn.sqhk.co/zadoweferoxe/miihehf/13434250261.pdf
    • https://cdn.sqhk.co/lazuxorus/fgfhDjd/wilderness_survival_kit.pdf
    • https://cdn.sqhk.co/nagigureti/UheZTHk/51654162840.pdf
    • https://static.s123-cdn-static.com/uploads/4472204/normal_5fcca86c378fe.pdf
    • https://cdn.sqhk.co/jigotove/kJhe2SC/margaritas_near_me_delivery.pdf
    • https://cdn-cms.f-static.net/uploads/4461786/normal_5fd90389a6928.pdf
    • https://cdn-cms.f-static.net/uploads/4424981/normal_602ed58444abd.pdf
    • https://cdn-cms.f-static.net/uploads/4500201/normal_6020be8dc5ea9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bd2200ef-8de8-4cb1-8608-1b1acf3e0530/setting_up_a_post_office_savings_account_for_a_child.pdf
    • http://kefixofelapadi.epizy.com/48213533542.pdf
    • https://uploads.strikinglycdn.com/files/2e01a374-7f98-4b42-86c1-27225afc36bc/far_from_the_tree_documentary_trailer.pdf
    • https://uploads.strikinglycdn.com/files/724fb2f9-ea84-43f8-a41e-0cabdd691743/bixava.pdf
    • https://s3.amazonaws.com/pexodugosa/jira_confluence_templates.pdf
    • https://s3.amazonaws.com/tobito/adding_fractions_and_mixed_numbers_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/6d8b4b25-4edf-42e1-903b-83c378c1e8db/the_little_match_girl_summary_questions_and_answers.pdf
    • http://fiviwuzovalexop.rf.gd/rajasthan_b._sc_nursing_online_form_2018.pdf
    • https://s3.amazonaws.com/neporezofov/sexipejidedeb.pdf
    • https://uploads.strikinglycdn.com/files/71acdb92-67a0-4be6-b00a-38a7d49bf398/film_storyboard_software_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c784.bin
9395e1435e2a059c0754a20cd92919920ae5633cb5d24db021b155184bf8c8a0
pdf-font-stream PDF embedded font (sfnt) at offset 0xC784 5220 bytes
font_01_sfnt_off0000d976.bin
4d01c8b7dda2b4dbb0d0ddb57904770f4dcd736ee199177606a692af9ba1409e
pdf-font-stream PDF embedded font (sfnt) at offset 0xD976 10024 bytes