Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c80842553449a73…

MALICIOUS

PDF

77.4 KB Created: 2021-03-29 04:03:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 21b2e531026bf3f566a69f2d3b6e46e6 SHA-1: 79d048a7b24cfcedf116004e6f08af7a7fadeb31 SHA-256: 3c80842553449a73f915da498ca34020f40c5a5441a09858d952e2e8d0fc784a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of external URIs, specifically one referencing a game guide, suggests a phishing or social engineering lure. While no scripts were explicitly extracted, the PDF structure and URI firings point towards a potential attempt to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=summoners+war+homunculus+guide+deutsch
    • https://liwifaxuje.weebly.com/uploads/1/3/0/8/130874244/ebbe450e6bf.pdf
    • https://logudapixifoke.weebly.com/uploads/1/3/4/3/134371583/tofexodijebusonuvapa.pdf
    • http://usacreditscore.info/how_to_pair_baby_monitor_motorola6fbfb.pdf
    • https://cdn.sqhk.co/tidilotofuka/gjXjfgd/medical_lab_technician_cv_format.pdf
    • http://tojokepolosuku.iblogger.org/ecological_plaque_hypothesis.pdf
    • http://malanefire.sportsontheweb.net/gulafupew.pdf
    • https://cdn.sqhk.co/vobipibomuk/w3iefig/jarisojobabaxuvos.pdf
    • https://bejuzozomixur.weebly.com/uploads/1/3/5/9/135966319/08cc83b46ccf16.pdf
    • http://gixipures.sportsontheweb.net/58420451972.pdf
    • https://cdn.sqhk.co/suwixowefa/cdhhPgd/crossfire_series_books_free_download.pdf
    • http://trokot-shtorki.online/lion_half_mask_templatedmmww.pdf
    • http://bullbananavannaone.xyz/47202749149sct5a.pdf
    • https://cdn.sqhk.co/fabupiguboxa/hajdjcM/road_traffic_conditions_m25_anticlockwise.pdf
    • http://giwepaz.iblogger.org/social_learning_theory_of_albert_bandura.pdf
    • http://immorta-cross1.club/good_food_guide_2020_liverpooli63lx.pdf
    • http://probkin34.xyz/zotifajekujornxo0u.pdf
    • https://cdn.sqhk.co/dorodidur/vdt4jb1/edge_lighting_samsung.pdf
    • https://sukuwakutas.weebly.com/uploads/1/3/4/6/134603616/zapuvidefelata.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zafijukopa/zatumasabowamibugujeme.pdf
    • https://s3.amazonaws.com/zarelusipofox/ledodinabomobokejedejuwa.pdf
    • https://s3.amazonaws.com/rilexazejuzovep/gexokefukowigodo.pdf
    • https://s3.amazonaws.com/remuv/aaru_songs_video_free.pdf
    • https://s3.amazonaws.com/dutimajizowa/business_introduction_powerpoint_template.pdf
    • http://bivojeda.atwebpages.com/spalding_basketball_hoop_parts_base.pdf
    • http://xuwomotibinifen.rf.gd/translation_worksheet_grade_5.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1cb.bin
90944028264f2554b47d0d5767157c99aa930f8a4c25b28c1210430a7d414bbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1CB 5548 bytes
font_01_sfnt_off00010483.bin
cd8225964d3a3176c1787436e9f978124f535e2ceae0b87fedcd40fbd53e106e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10483 10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.