Malicious PDF — malware analysis report

Static analysis result for SHA-256 45416609eeb88dbc…

MALICIOUS

PDF

77.9 KB Created: 2021-03-29 14:20:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 034fae0c8e720193263a852f1a7fd410 SHA-1: 0714caadd08e0eccbd7a57737a42a8bedb015661 SHA-256: 45416609eeb88dbc5a4b3b113ba1eaced0fdb5a7991cd280f943e4238374cd3f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a URL that appears to be a phishing lure, disguised as a search result for a popular game topic. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL is the primary indicator of compromise, suggesting the document's purpose is to redirect users to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=how+to+spawn+arceus+pixelmon PDF link annotation
    • https://cdn.sqhk.co/tigoxexuda/bicjgqc/sago_mini_robot_party.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409093/normal_60570488e4505.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4477139/normal_5ff2b2cbe70a8.pdfIn PDF document text
    • https://cdn.sqhk.co/libavesonon/jefjbij/guarantee_letter_format_for_loan.pdfIn PDF document text
    • https://cdn.sqhk.co/fofateze/bDNhgja/12111672458.pdfIn PDF document text
    • http://stassikorskyi.com/auld_lang_syne_piano_chordsuw723.pdfIn PDF document text
    • https://cdn.sqhk.co/vukixukafoga/M1vfheo/apostolic_faith_mission_membership_form.pdfIn PDF document text
    • https://cdn.sqhk.co/gaxozamikoge/fnyNckr/24955471668.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365575/normal_5ff1f0b29e4d4.pdfIn PDF document text
    • https://cdn.sqhk.co/busumodofu/gphcegj/bones_series_6_episode_guide.pdfIn PDF document text
    • http://sallely.xyz/why_are_clothes_not_drying_in_dryer7wzmy.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366331/normal_600d932486acd.pdfIn PDF document text
    • https://cdn.sqhk.co/fodexuxefeba/iHgdidb/mpl_premier_league_app_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379230/normal_603356164bd72.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vufupu/tax_allowances_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/jevelel/35580938253.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/670b4cc1-b6f1-44cb-9447-a56d21ddca9b/is_citizen_watches_good.pdfIn PDF document text
    • https://s3.amazonaws.com/fidobakipivogit/vivo_themes_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/965d2feb-b497-4002-b96f-330e6f8eabb1/felopimagurimuzoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/359a18f5-d3d4-41cf-8b60-64a34b07443b/famiseviwofakow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a12b3c2-4ba1-456c-9cbb-7b14d9a178ed/xofuserawinipox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a39f9500-c87d-46c7-a27f-4079809f9463/evinrude_25_hp_etec_2-stroke_outboard_motor.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d135.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD135 3808 bytes
SHA-256: 14e2922c40b85b4155391265abea21e2d0a6544642267660f398fd2417809511
font_01_sfnt_off0000dedc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEDC 5200 bytes
SHA-256: ec0f638e9aee85dd5cf869ed784adc45193a5edea000d245da21bcdd71f7a73d
font_02_sfnt_off0000f083.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF083 10644 bytes
SHA-256: d8fb38485f1be9ba91b6603c561a4653c8acb60bd00746234de09701ccbf2ada
font_03_sfnt_off000114d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114D3 16076 bytes
SHA-256: 75bbd65b209dd63d03d218c8a080e02e74e48388e264bced155518a984d3e53f

Open this report in the interactive analyzer, or submit your own file for analysis.