Malicious PDF — malware analysis report

Static analysis result for SHA-256 54b52b78af2abd87…

MALICIOUS

PDF

85.3 KB Created: 2021-03-15 04:07:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 98e5869496ab304c280977cee39868bf SHA-1: e4f10a75dd7f8ae5d6ea77cf1516f0b0b7ebe2de SHA-256: 54b52b78af2abd875dbf487b3073cb713a2c07e7963f13e7fe112469b77e0291
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL pointing to a site offering 'miragine war unblocked hacked'. This suggests a lure to a potentially malicious site, likely for phishing or to download further malware. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=miragine+war+unblocked+hacked
    • https://falukanujenujo.weebly.com/uploads/1/3/2/8/132815213/xegegubobokapi.pdf
    • https://wutuzorul.weebly.com/uploads/1/3/5/9/135963099/50a57e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0ea1ff7f-05b3-43a2-9744-178351a05ed1.filesusr.com/ugd/01f9b9_370472b582eb43b5851bbb9a999ca4d5.pdf?index=true
    • https://s3.amazonaws.com/dapekufoxiraku/gaali_chirugaali_song_com.pdf
    • https://uploads.strikinglycdn.com/files/e4448e44-a118-4991-a8cd-430f09ab6b85/what_are_the_big_five_personality_tests.pdf
    • https://s3.amazonaws.com/ganubifirigevi/xitemofobokivopobowoxonen.pdf
    • https://s3.amazonaws.com/gumagabu/will_roku_stock_go_up.pdf
    • https://18282f24-d4e3-4c19-b4d9-8e3fdaa82145.filesusr.com/ugd/df2b7b_bf446d90dba4494caea721cd0b954c80.pdf?index=true
    • https://s3.amazonaws.com/padosumifubobo/82812867370.pdf
    • https://uploads.strikinglycdn.com/files/05ee2602-047b-4e46-9013-6a8b4fdae767/48558976374.pdf
    • https://s3.amazonaws.com/wovugi/ziniledakolukapu.pdf
    • https://s3.amazonaws.com/mujevubutukoxu/can_t_let_u_go_video.pdf
    • https://uploads.strikinglycdn.com/files/4a3f16a8-9ebb-4a34-bff4-05dd4419f010/vocabulario_de_teologa_bblica_leon_dufour_gratis.pdf
    • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_af39df0023b74b0a85b6bf8e6b349c4a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/61ed4502-ed5f-47f1-a3e0-47458b700757/soil_mechanics_and_foundation_engineering_in_hindi.pdf
    • https://728bf1be-24e3-4891-ba98-fedceca1a503.filesusr.com/ugd/3268c8_ca10851acb2f40089116d4cd050d70b2.pdf?index=true
    • https://e3055f73-6236-423b-b810-4bc1a15f300f.filesusr.com/ugd/fa12d1_a07bf495578743a9a54aadfe874a41d9.pdf?index=true
    • https://s3.amazonaws.com/gonafoziguwewe/79007540715.pdf
    • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_d436c81b8f5a45adae1fd3db29492e5d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f991ebdb-6a46-466b-9709-a346ccd3290f/im_ok_youre_ok_mxpx.pdf
    • https://s3.amazonaws.com/vososasoxumete/why_school_uniforms_should_be_mandatory.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc29.bin
048fb1891f432488516cd811e7b04d68e7d39e548ca3495625137f8fb0c23ff4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC29 6744 bytes
font_01_sfnt_off00010d0e.bin
962b8c6ad375c191d19a795d553dce60b89dae8b78bc415ff634a8ae31a1251b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D0E 5324 bytes
font_02_sfnt_off00011f3e.bin
ebacb4a074b31f9a6df053bd48fc20498d1c5437a23383829bcbf46a2053d9a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F3E 11436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.