Malicious PDF — malware analysis report

Static analysis result for SHA-256 5eb456ea858df74e…

MALICIOUS

PDF

106.0 KB Created: 2021-04-02 12:02:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 80a93560b031aed4b0b25dae6b11109d SHA-1: 98174806a1754d56beeec6a18d6762b4a70720a6 SHA-256: 5eb456ea858df74e11758c01f7e703b1f55ec389e47f6951376c8f5d02fa3157
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to download an Android application. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution. The presence of an external URI and embedded URL points towards an attempt to trick the user into downloading a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=360+root+apk+free+download
    • https://cdn-cms.f-static.net/uploads/4447276/normal_5fd14732ed481.pdf
    • https://webegerux.weebly.com/uploads/1/3/4/7/134759049/gelopozekatosawikuxe.pdf
    • https://static.s123-cdn-static.com/uploads/4392867/normal_5fdfc219190ec.pdf
    • http://xenuven.22web.org/malachi_martin_libros.pdf
    • https://cdn-cms.f-static.net/uploads/4493597/normal_5fdc04a480126.pdf
    • https://zaruneza.weebly.com/uploads/1/3/2/8/132814400/426be24a4b99.pdf
    • https://cdn-cms.f-static.net/uploads/4495402/normal_5fd66ae757100.pdf
    • http://wuxirumamep.iblogger.org/whirlpool_commercial_water_dispenser_water_cooler_with_ice_chilled_water_cooling_technology_white.pdf
    • http://natusab.22web.org/27332624566.pdf
    • https://static.s123-cdn-static.com/uploads/4425256/normal_5fe56d247b38b.pdf
    • http://tadekurujere.22web.org/9th_class_english_textbook_ap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3bcdeb60-9876-4d14-bc0a-1dd1632c647c.filesusr.com/ugd/16a96a_b4eb4499e57842e485ee81098bf2662a.pdf?index=true
    • http://rajimorix.rf.gd/25007249982.pdf
    • http://puteroxono.epizy.com/transfer_android_chrome_bookmarks.pdf
    • http://sezajuvijib.rf.gd/academy_stars_3_teacher_s_book.pdf
    • https://a815f367-2516-4b88-9496-eed07d5c1eb7.filesusr.com/ugd/665c20_34e1cdd794424c7eba62c857c73e719c.pdf?index=true
    • https://s3.amazonaws.com/vukumesoj/wuliterewulafetojiwula.pdf
    • https://s3.amazonaws.com/niporofez/rebelion_en_la_granja_caracteristicas_de_los_personajes.pdf
    • https://s3.amazonaws.com/padanivozeb/kexal.pdf
    • https://91506351-5699-48ce-85e7-8e7d071f4e87.filesusr.com/ugd/d775a9_8ed596150cd046fb91817aaf6e9e6764.pdf?index=true
    • http://bidexegope.epizy.com/19117647539.pdf
    • http://vobewegogiz.rf.gd/83489942163.pdf
    • https://f1c0478e-57b3-422a-b8eb-433964b677d2.filesusr.com/ugd/16c17d_c57b1321220f4a5f9921a6ac147d69bc.pdf?index=true
    • https://s3.amazonaws.com/bolovopizonuki/bloons_tower_defense_5_apk_working.pdf
    • https://d6ac5066-27fc-4e71-a07d-b30af50dfe8b.filesusr.com/ugd/934fc3_d2e2d7f9359d421486ba86f66fcd2d8d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9e6.bin
42d7a28ed7348a46a947bf7fbd6552123944d6fa0b01091e7ec317cb1558abe3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9E6 31716 bytes
font_01_sfnt_off00014b94.bin
470e3c8989392b88d609df885d9d7685165f4be63ace6b3f146e50fa5a4f508b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14B94 5380 bytes
font_02_sfnt_off00015e03.bin
aac08e78aa178f4d0bbf72626ea220e4fd3d08950c1b29567b09110f213d47a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E03 10656 bytes
font_03_sfnt_off00018206.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18206 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.