Malicious PDF — malware analysis report

Static analysis result for SHA-256 65077d8f8749b661…

MALICIOUS

PDF

81.0 KB Created: 2021-03-20 11:41:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8b1eb8647fb8b915bd1dd533edb02529 SHA-1: 466f72b049d3fa46087ad187e29e51da1ae23936 SHA-256: 65077d8f8749b6616100105ed1f719ddfa9fcd9be4345fe9d3de356b4ce60a3d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a website offering a "gta vice city apk free download ios". This is a common lure for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or trojan delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=gta+vice+city+apk+free+download+ios
    • http://kostlike.site/cold_chisel_songs_freehgj7z.pdf
    • http://6gusevshop.space/critical_thinking_concepts_and_tools6pmv6.pdf
    • https://cdn-cms.f-static.net/uploads/4419198/normal_5fd8807824525.pdf
    • http://zuviwadakaji.22web.org/greek_play_antigone_characters.pdf
    • http://zemawage.22web.org/smudge_the_cat_meme_template.pdf
    • https://cdn-cms.f-static.net/uploads/4483870/normal_602a33a852d00.pdf
    • https://cdn-cms.f-static.net/uploads/4464862/normal_605329f6db3fe.pdf
    • https://cdn-cms.f-static.net/uploads/4405946/normal_6050d17760338.pdf
    • http://jobauthor.online/828036406600aui1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/jifesu/fgdp_guidelines_antibiotics.pdf
    • https://uploads.strikinglycdn.com/files/42417ce9-0383-4cd2-b587-bbb651169f51/fopis.pdf
    • https://uploads.strikinglycdn.com/files/e93bb16f-5e56-44b5-ad45-186a7e287705/93320384053.pdf
    • https://s3.amazonaws.com/kegubinefuda/62910293879.pdf
    • http://zusobudem.epizy.com/common_medication_prefixes_and_suffixes.pdf
    • https://s3.amazonaws.com/sizadagazagaj/what_does_the_wps_button_do_on_a_router.pdf
    • http://fefijenaxub.rf.gd/biology_notes_for_railway_exam.pdf
    • http://zufosigikirir.epizy.com/maxujixevaxikijazijed.pdf
    • https://s3.amazonaws.com/jolunenafobuw/has_been_heroes_trophy_guide_and_roadmap.pdf
    • http://masifegudogona.rf.gd/nutritional_information_everything_bagel_with_cream_cheese.pdf
    • https://uploads.strikinglycdn.com/files/1011f316-31f0-4afe-8ab9-261a472e25e6/pocket_bike_throttle_cable_repair.pdf
    • http://vumigewinumuzi.epizy.com/nowevafumunop.pdf
    • https://uploads.strikinglycdn.com/files/069a8c9b-14d3-405a-ad17-8dd17e8c7828/midofuva.pdf
    • https://uploads.strikinglycdn.com/files/0790b3aa-d297-4276-b27b-544a212dd997/60890316670.pdf
    • http://mafukifuwu.epizy.com/what_is_movement_in_art_and_design.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0da.bin
f42ea2dba832af8f41a70edceb4f0b842bab8fac15fcbf8ab6ca967678f4a0b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0DA 5288 bytes
font_01_sfnt_off00010307.bin
9c7f765dc29ce9f93c22315995cc563e5d5ee6f9350d82a3355c4a4031110a4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10307 10920 bytes
font_02_sfnt_off00012855.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12855 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.