Malicious PDF — malware analysis report

Static analysis result for SHA-256 60ac5922c44e0233…

MALICIOUS

PDF

84.8 KB Created: 2021-02-27 10:29:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: bdf9f481b166b72a751133b13427e6dd SHA-1: 2d8f37a15f7f02d3d6647a64b67609cfb104ebd0 SHA-256: 60ac5922c44e023338d8f2a8890139db50a3cfcbca8bf701dc09c6ee76f190da
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. The document body references a 'digimon links hack apk 2019', suggesting a lure for users seeking game cheats or exploits. Several external URLs are embedded within the document, likely serving as download locations for malicious payloads or redirecting to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=digimon+links+hack+apk+2019 PDF link annotation
    • http://xuxetosufuzo.getenjoyment.net/mantis_tiller_for_sale_uk.pdfIn PDF document text
    • http://kakolamilasaru.medianewsonline.com/how_to_replace_bulb_on_epson_powerlite_83.pdfIn PDF document text
    • http://it50disconto.pro/how_to_charge_sony_dsc_h300e6d6j.pdfIn PDF document text
    • http://woziwowariv.sportsontheweb.net/panasonic_microwave_oven_nn-sn766s.pdfIn PDF document text
    • http://mysteps.online/minecraft_apk_ios_no_jailbreakxv6rz.pdfIn PDF document text
    • http://pedosapabosa.iblogger.org/boost_confidence.pdfIn PDF document text
    • http://lapitubemexidi.mywebcommunity.org/norcold_rv_fridge_manual.pdfIn PDF document text
    • http://kadaxejob.mypressonline.com/python_coding_notes.pdfIn PDF document text
    • http://cloudmarket.website/a_discovery_of_witches_season_2_release_daten33jc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xupimaral/rapupoletidi.pdfIn PDF document text
    • http://wamunezufim.rf.gd/error_handling_in_c.pdfIn PDF document text
    • https://s3.amazonaws.com/mejifavo/62801731697.pdfIn PDF document text
    • http://rogofideb.onlinewebshop.net/4348457034.pdfIn PDF document text
    • https://s3.amazonaws.com/kifutizijebuj/android_auto_sync_3_issues.pdfIn PDF document text
    • https://s3.amazonaws.com/tevomenil/rexeruvejeju.pdfIn PDF document text
    • http://widusop.atwebpages.com/dekerepizu.pdfIn PDF document text
    • http://xajamojepoz.rf.gd/architectural_photography_books.pdfIn PDF document text
    • https://s3.amazonaws.com/nuxomigo/44710314751.pdfIn PDF document text
    • http://galikamot.epizy.com/28171806616.pdfIn PDF document text
    • https://s3.amazonaws.com/sojenozap/georgia_dmv_permit_test_requirements.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE4F 5748 bytes
SHA-256: 0bf05a18fb58ae464960343955cc0b9ba204871b317f603e0499c19e5ed21853
font_01_sfnt_off00010249.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10249 5796 bytes
SHA-256: 44c51561843b3302826dcca30d0bb9334c20639b41cef6220064db60a72a1623
font_02_sfnt_off000115f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115F2 14724 bytes
SHA-256: 47682de97b2517220f46de7ba730185aad526bc87c1d199aa56ba535a3ca5535

Open this report in the interactive analyzer, or submit your own file for analysis.