Malicious PDF — malware analysis report

Static analysis result for SHA-256 42e4717e7fe9e612…

MALICIOUS

PDF

79.8 KB Created: 2021-03-25 20:34:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6115b012087a8a8be2fd921b4f108e77 SHA-1: a9e6bcd6896fc304096e52fcddaeea67d885778f SHA-256: 42e4717e7fe9e6129012a69f013af4e175596fee25394910b499246fceb95443
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain and is presented as an Android launcher APK, a common lure for phishing attacks. No scripts were extracted, but the PDF structure and external URL suggest a phishing attempt to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=anole+android+launcher+apk
    • http://zebisol.mypressonline.com/99847946710.pdf
    • https://cdn.sqhk.co/baruduwege/geCjfjg/disaster_survival_kit_list_and_uses.pdf
    • http://mavaxur.mywebcommunity.org/87208053547.pdf
    • http://worelimupuvefam.mywebcommunity.org/86122354826.pdf
    • https://cdn.sqhk.co/gepaxulunan/djgZLje/nawogenesonifaxe.pdf
    • http://numulul.mygamesonline.org/kebeso.pdf
    • http://pagavopalubutu.scienceontheweb.net/dobejoxoxagepezakewokit.pdf
    • https://cdn.sqhk.co/ralapogifur/idTllc7/beard_oil_for_growth_walgreens.pdf
    • https://cdn.sqhk.co/rikopekela/7HkOPhh/nejulug.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://romakilax.myartsonline.com/94028919846.pdf
    • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_2ede7cf1d9144a2ba7100efb966957d1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0b223e8e-b9c0-4ec5-8340-0d7f46be140c/verb_worksheets_for_10th_grade.pdf
    • http://lufiwivumijej.myartsonline.com/vowikokelokudererozotadop.pdf
    • https://uploads.strikinglycdn.com/files/77eb649f-5622-4822-9bfb-08d13fb2b8b0/honda_hs520_owners_manual.pdf
    • http://kizufalugomux.atwebpages.com/basic_medical_english.pdf
    • https://0cfe495c-9a5f-46a1-a5f3-fb21b6211bac.filesusr.com/ugd/7aabb2_6fa4362218d2462682cb8b155e318604.pdf?index=true
    • https://d5bea983-5bca-41ba-aae6-6b688785cc77.filesusr.com/ugd/9ec29b_9a4466e1d2ee4f86a09068bc763e404f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/eb993cca-de60-47b8-9e07-d3164a19a16a/88442592874.pdf
    • http://zipemoluligera.myartsonline.com/tobakivanuwozugodesi.pdf
    • https://0c43c058-97b3-435a-b041-a9f001bfa883.filesusr.com/ugd/791d74_796b08ae31c84ee3ad292c3b30e53b15.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef45.bin
884cbfdeb878ee20e2c146b05a1641383b41b88cd86c369d761b3a8bde37f1a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF45 2900 bytes
font_01_sfnt_off0000f99c.bin
07a1dd6b5a82877687bba3e74a472104ce30ee08328b08385663a56efeaf3eac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF99C 5036 bytes
font_02_sfnt_off00010ab7.bin
3d43ad918838859f5a7f2807d3f2f32d46e8f8dbbb52c1baf3d26628c69f585b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AB7 11264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.