Malicious PDF — malware analysis report

Static analysis result for SHA-256 5958c1890c0957ac…

MALICIOUS

PDF

71.6 KB Created: 2021-03-20 03:59:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 492df962af11433d0c712c8523ba65fd SHA-1: f4ebe964d5f746fd8f7239c0f36e3dbb7617f774 SHA-256: 5958c1890c0957ac15a89ffb6db7cf22f6fb0c6ad5ae3d090697ac713602e9b3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://dafemum.ru/wix?keyword=castle+clash+mod+apk+ios` suggests a phishing or malware distribution lure, likely attempting to trick users into downloading software. The PDF structure and embedded URI heuristic further support the classification as a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=castle+clash+mod+apk+ios
    • http://reduslim-ufficiale.website/burger_king_gutscheine_oktoberf87tk.pdf
    • https://cdn.sqhk.co/zolokike/lij0Nhc/movistar_plus_apk_android.pdf
    • http://podipotekoi.ru/sozokuvewawetelezatapesjnt4o.pdf
    • http://trastenmyqort.online/aspen_colorado_court_reporterdmcpw.pdf
    • http://p-kavkaza.ru/milton_bradley_electronic_battleship_instruction_manual3fap4.pdf
    • https://cdn.sqhk.co/daborofus/ij9ojem/wufofedopisalafududixifid.pdf
    • http://dmdmassage.com/pobazuposawr2n81.pdf
    • http://grenkasalo4.xyz/gefujesepabimozf3x00.pdf
    • http://serviceforyou.site/how_to_become_more_self_disciplined_like_in_the_militarytmy3z.pdf
    • http://life50it.pro/damovedirepogagu5ks2q.pdf
    • https://cdn.sqhk.co/dejegekonula/cGj8iju/mikofajabikivu.pdf
    • http://hallhq.xyz/48984339592km6wv.pdf
    • http://blekrossi.ru/what_is_the_healthiest_meal_at_chick_fil_ajvlzn.pdf
    • http://senteber.site/vatagewetodotelakajiveri7wp38.pdf
    • https://cdn.sqhk.co/pevejotomoma/hbLgYIc/sonic_adventure_3ds_port.pdf
    • https://cdn.sqhk.co/wudajelu/dWidZgt/30528312348.pdf
    • http://instahelpforbusiness.com/negibmnrj1.pdf
    • http://virona.org/38132579163jtc8r.pdf
    • https://cdn.sqhk.co/ruwuwedelo/a3B6frX/silver_dollar_city_christmas_tree_videos.pdf
    • http://my-favshopc.online/dodge_ram_1500_parts_canadali7en.pdf
    • https://cdn.sqhk.co/letinumi/XhbRjfN/ice_cream_van_song_south_africa.pdf
    • https://cdn.sqhk.co/walumupo/jdVJp7M/36001745314.pdf
    • https://cdn.sqhk.co/nububufi/WYrgcgh/stickman_legends_shadow_wars_apk_mod_atualizado.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d9e4.bin
31401a97820240802f10ba2ec155efe402ed63e1daa32b656655f7eeaeee05bc
pdf-font-stream PDF embedded font (sfnt) at offset 0xD9E4 5188 bytes
font_01_sfnt_off0000eb5b.bin
984d87b7c179040cf8d9889bf94319d7ff05886a9fc1cc10fb1ffabbe6676d89
pdf-font-stream PDF embedded font (sfnt) at offset 0xEB5B 10572 bytes