Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d07430ab12f82d1…

MALICIOUS

PDF

85.9 KB Created: 2021-04-14 14:54:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1e55ffd4de914266ffb19d99f523039 SHA-1: 9c190dd2ec8339d41fea1f3a652d2ff1839946eb SHA-256: 3d07430ab12f82d1d54917f71d7e314447665541ca42465b39c2a7d625d2b78c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading further malware or visiting a phishing site. The document body, though heavily obfuscated, contains references to 'ff vii remake 2 ps4', suggesting a lure related to video games.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=ff+vii+remake+2+ps4
    • https://cdn-cms.f-static.net/uploads/4366662/normal_60445a2768756.pdf
    • https://cdn-cms.f-static.net/uploads/4480755/normal_602092b93a448.pdf
    • http://vojupobakovax.iblogger.org/49630050307.pdf
    • https://cdn-cms.f-static.net/uploads/4389101/normal_5fd7a0b4dff1f.pdf
    • https://cdn-cms.f-static.net/uploads/4475586/normal_605485313c728.pdf
    • http://sukovuxelex.22web.org/editing_removing_pages.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fezafugalofibid.epizy.com/bajaj_allianz_car_insurance.pdf
    • https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_3503d51619f54b1f85604ac52f37f49f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fb5a3b67-cdc5-49b4-b321-c170c48bf4c3/5287301955.pdf
    • https://uploads.strikinglycdn.com/files/0083015c-e28d-49a2-ba62-e98283bf11e6/my_family_and_other_animals_1987_tv_series.pdf
    • https://033a7475-7ccb-45c1-8f1e-38fd320d48d0.filesusr.com/ugd/03a576_c0b547286e2149aca77ad5a8b9bc2ef2.pdf?index=true
    • http://fuvudox.epizy.com/gedanupulajaza.pdf
    • http://jigipowomazavas.rf.gd/25708476080.pdf
    • https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_3c5ccb81c8ac4c049c4583eab092f420.pdf?index=true
    • http://luwekexopevom.rf.gd/barnum_musical_script.pdf
    • http://rujipezoj.epizy.com/pelafomegedetoj.pdf
    • https://uploads.strikinglycdn.com/files/b11927a3-8e95-4378-96dc-cdf077370e7b/gomajujugaxutututo.pdf
    • https://ad9f1622-e3b7-49db-bfef-326c48fb2104.filesusr.com/ugd/a467d2_c932a1a5ea96476ab44576d373aa36b9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/16e7cbca-529c-46c7-9396-130cd7ddb6f7/cisco_nexus_5000_multicast_configuration_example.pdf
    • https://uploads.strikinglycdn.com/files/d9a8ae04-39b1-400f-b4a4-483490daec13/what_is_the_scariest_story.pdf
    • http://jebowozuguvufot.rf.gd/international_arbitration_act.pdf
    • http://mekededijafefuv.epizy.com/53723959114.pdf
    • https://0df6220b-9630-4647-aab6-0d9db69b9d59.filesusr.com/ugd/8b97dd_e63546a78a03449dbc5b6bcb1e02455f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee6a.bin
0657c09d58f33055f2ba34ad4d4b91d0ed6cbedfba7af0e130e8c894b829936c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE6A 3452 bytes
font_01_sfnt_off0000fac0.bin
e125ff1697d79864982c54a322580127f6945abe9da067120a0e1242afa7693d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAC0 5316 bytes
font_02_sfnt_off00010cd0.bin
87f3ae7d9aefc80c8ad60c9a7e1b45f2b73d6e43871e684ff4d4aba865110c02		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CD0 11064 bytes
font_03_sfnt_off000132ee.bin
6c511cd2548aab1566dad8f54fccf2be4cd056cf5a4d5d56937977fde9165995		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132EE 16132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.