Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c2dca93907f2c96…

MALICIOUS

PDF

79.2 KB Created: 2021-03-14 13:52:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 25b8be1e031205d5cb9ede89c8540e65 SHA-1: b81657bfbd9b2b7decdf7be819cdf3a33f051827 SHA-256: 5c2dca93907f2c96acaa2cc0a2dc0179ed898ffbc95b47880c2a68fe4aef6067
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'dugedepap.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to game masteries, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=gw2+how+to+unlock+masteries PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4494893/normal_6049a57914b0e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377924/normal_601be3dd0610c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389797/normal_5fd5f6d5a749c.pdfIn PDF document text
    • http://pepujolajerikur.66ghz.com/letefufikitin.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4497372/normal_6008acd426d0b.pdfIn PDF document text
    • http://albatros-trans.ru/schlage_keypad_deadbolt_blinking_redmziyy.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424330/normal_5fd26c9f84a89.pdfIn PDF document text
    • http://summ-ita.space/78314208675e9zw3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446152/normal_601fce7b27328.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377704/normal_602a12a3717b7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465702/normal_60178367ab70d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/47893425694.pdfIn PDF document text
    • https://s3.amazonaws.com/gifiz/tutorial_on_how_to_make_a_face_mask_with_pleats.pdfIn PDF document text
    • http://voxonirejeze.epizy.com/61891235443.pdfIn PDF document text
    • https://s3.amazonaws.com/rokuwapesu/contemplate_life.pdfIn PDF document text
    • https://s3.amazonaws.com/zuponefi/zoomer_zuppy_instruction_booklet.pdfIn PDF document text
    • https://s3.amazonaws.com/besafefaf/the_bermuda_triangle_mystery_solved_book.pdfIn PDF document text
    • http://rakejobik.epizy.com/lerogubami.pdfIn PDF document text
    • https://s3.amazonaws.com/nedijowewoded/62237944315.pdfIn PDF document text
    • https://s3.amazonaws.com/galinikagopit/tabixobedofuwolivonu.pdfIn PDF document text
    • https://s3.amazonaws.com/kegovev/wastewater_treatment_plant_operator_certification_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6B2 5360 bytes
SHA-256: 7e670c1798ec71dd5827bb497011d0a8f572e74b9f4b4a60ac6c496a96408082
font_01_sfnt_off000108d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x108D2 11740 bytes
SHA-256: 45abec860cbb481483384588cd2546183d58ea314a75143a6496dad4756fbde1

Open this report in the interactive analyzer, or submit your own file for analysis.