Malicious PDF — malware analysis report

Static analysis result for SHA-256 389d58138e33af4e…

MALICIOUS

PDF

81.2 KB Created: 2021-04-05 03:41:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c8540a90120a7b60ad35619cccf6d7f3 SHA-1: 7fee527f389085cc289bda3f39a7d329d0e030e9 SHA-256: 389d58138e33af4ef0ac7475899c91f08148f0e890b39727bf5b9d9d96d8b862
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that redirects to a malicious domain. The document body, though heavily obfuscated, appears to be a lure related to 'car games unblocked 3d'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=car+games+unblocked+3d
    • http://feremujidonigu.getenjoyment.net/best_mobile_phone_for_hearing_impaired_seniors.pdf
    • https://static.s123-cdn-static.com/uploads/4383582/normal_5fde18c03c78c.pdf
    • http://gadivawiw.sportsontheweb.net/89586591673.pdf
    • http://nujijaj.getenjoyment.net/96528446813.pdf
    • http://birapemotafew.mygamesonline.org/42970274468.pdf
    • http://kakaxazirobolob.iblogger.org/great_guitar_songs_to_learn_electric.pdf
    • http://nejetevu.22web.org/atlas_world_map_book_free_download.pdf
    • http://xedeporib.medianewsonline.com/reasoning_questions_and_answers_for_bank_exams.pdf
    • https://static.s123-cdn-static.com/uploads/4427795/normal_5ffcff1c7f4be.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://0ea28b16-58c2-472d-b6be-3e97fe9b7bb6.filesusr.com/ugd/696b8a_62d786c6dc0c4d16a124a58ea33e9291.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9f81a1cf-5937-4eef-9b71-ac61d2d55f47/somebody_snitched_on_me_chords.pdf
    • http://kaloruligot.onlinewebshop.net/fikunagigiraxuwotox.pdf
    • http://sugamane.onlinewebshop.net/also_sprach_zarathustra_piano.pdf
    • http://sukokovevaz.atwebpages.com/13_attributes_of_god.pdf
    • https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_d6e866bf64f544ae9041ac9511fb3a8b.pdf?index=true
    • https://78905da9-dd21-4190-abaa-c894c042e703.filesusr.com/ugd/851c7c_40ea478ee0954c709de62661abff6ef8.pdf?index=true
    • https://5f90d536-2a72-4461-adff-280afd3056cb.filesusr.com/ugd/27c394_10f857549f1b485890345a6f552f156c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a8a3d286-f1da-4850-a5a1-197b9c2162ba/87950827765.pdf
    • http://kofupugixujodin.epizy.com/bharata_simha_reddy_movie_audio_songs.pdf
    • http://mawekipabotore.epizy.com/phase_4_letters_and_sounds_assessment_sheets.pdf
    • http://tiredosutozol.atwebpages.com/recent_advances_in_microbiology.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2c9.bin
a75964769c189c798af9d4baf76229149d6fc16b04ad662de33fa58efe688e93		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2C9 5404 bytes
font_01_sfnt_off0001050d.bin
82a69f260df76ae2174f3ecb70c47e466aeed89283fb908eddf158c2472d36db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1050D 10500 bytes
font_02_sfnt_off000128cb.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128CB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.