Malicious PDF — malware analysis report

Static analysis result for SHA-256 626f144dd07b16e4…

MALICIOUS

PDF

88.6 KB Created: 2021-03-05 21:47:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4df7c651ba8b717cc3f95fe464b47fa SHA-1: 7c8365f354841eadb1998b1acf6ea6697154a7d9 SHA-256: 626f144dd07b16e40f341718c8c98eab3b4295629ba3d5e997b00968ea45925b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a website disguised as a game walkthrough, likely a phishing lure. ClamAV and ML classifiers also flagged this file as malicious, indicating a high probability of malicious intent. Although no scripts were explicitly extracted, the presence of embedded URLs and the document's deceptive content strongly suggest it's part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=digimon+world+3+walkthrough
    • https://cdn.sqhk.co/denepepunuja/eBiegco/sis_vs_bro_videos_challenges.pdf
    • https://static.s123-cdn-static.com/uploads/4370052/normal_5fcef86b8f875.pdf
    • https://cdn.sqhk.co/xakelafu/ihdibgj/46620578514.pdf
    • https://static.s123-cdn-static.com/uploads/4389603/normal_5ff5a7c5f0a6d.pdf
    • https://cdn-cms.f-static.net/uploads/4486772/normal_60149faa9d72c.pdf
    • https://static.s123-cdn-static.com/uploads/4468572/normal_5ff637d8c1c4b.pdf
    • http://pusulij.22web.org/85137955386.pdf
    • https://bevazamosip.weebly.com/uploads/1/3/5/3/135345421/kurirud_bopiwijeluto.pdf
    • https://xakexoxos.weebly.com/uploads/1/3/4/3/134307698/6944106.pdf
    • https://tupirusu.weebly.com/uploads/1/3/4/7/134702138/tenadegi.pdf
    • https://redelonoxoti.weebly.com/uploads/1/3/1/6/131606094/a459e81.pdf
    • https://cdn.sqhk.co/bosamame/gjjHXjc/rebel_inc_brutal_tips.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://volomuladifute.rf.gd/xuvokosoxop.pdf
    • https://uploads.strikinglycdn.com/files/05ee0421-171c-4b58-9806-fa5978b4d1c8/36348418634.pdf
    • https://uploads.strikinglycdn.com/files/41310ec4-d28d-4ffa-96d0-1a5cbd85b6aa/soft_white_non_led_christmas_lights.pdf
    • https://uploads.strikinglycdn.com/files/cc46a8a5-9b3b-4afc-89cd-c6b428837b29/riwewamib.pdf
    • http://fariwugakek.rf.gd/anesthesiologists_manual_of_surgical_procedures.pdf
    • https://348ddb29-83e1-4812-94a1-743b72ef9b42.filesusr.com/ugd/23b571_d197ebc93f294359aebe3429893c4ab6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ec582bc8-cf02-4fd0-9161-710a52f13715/what_is_the_difference_between_public_relations_and_community_relations.pdf
    • https://uploads.strikinglycdn.com/files/4141dffe-1eea-48fe-9614-37c43159ff25/does_electricity_get_cheaper_at_night.pdf
    • https://9579f988-9383-433c-acf3-5fff76e0c882.filesusr.com/ugd/191a6d_1768a4a5e752460e974096c7c25f4c93.pdf?index=true
    • https://0296ecfc-28ae-4fa5-925c-67a25994cace.filesusr.com/ugd/c88839_37963f36716741f2a0869996ec2cbe79.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001082f.bin
9f73751d9a21db32bb1f4beabbae8125f92c914a6e6bef32b75be77ff5ea2690		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1082F 5380 bytes
font_01_sfnt_off00011a64.bin
14112307d3a73d1f6a7d23dc41ca7bf19c92ed56cec92c4d5df781db697764db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A64 10856 bytes
font_02_sfnt_off00013f9e.bin
c5b81f703ebddc697e6824868dcd306aba919aa4c1ec28f594a83a04df97872b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F9E 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.