Malicious PDF — malware analysis report

Static analysis result for SHA-256 654de603916cf960…

MALICIOUS

PDF

217.8 KB Created: 2021-03-30 09:18:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5374bcbd5dbe9443ccd8c6bd5c76bec2 SHA-1: bf90211cfcf1a675c01447e5a346071d1629da3a SHA-256: 654de603916cf9603dd7c0d8c43bb17fc21328d5a65fc9c51d97f4d69fbccf96
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded URLs and heuristic detections indicating malicious intent, specifically a phishing lure related to 'remote play apk xda'. The ML classifier and ClamAV detection strongly suggest this is a malicious PDF. The document body, though heavily obfuscated, contains references to the wkhtmltopdf tool, suggesting it may be a generated document used for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=remote+play+apk+xda
    • http://xawexusinuzo.22web.org/13971649904.pdf
    • https://cdn-cms.f-static.net/uploads/4408478/normal_60108ccaa3e09.pdf
    • https://fofavaduk.weebly.com/uploads/1/3/4/4/134436242/tunimuzewezidaxew.pdf
    • https://dipilewojariwu.weebly.com/uploads/1/3/2/8/132814651/3860836.pdf
    • https://static.s123-cdn-static.com/uploads/4462368/normal_5fe004c2acede.pdf
    • https://tuwavufubuxa.weebly.com/uploads/1/3/3/9/133997694/fuduzev-zululeda-zafemuwes-sofitafitijo.pdf
    • https://cdn-cms.f-static.net/uploads/4411696/normal_603c7bde7e922.pdf
    • https://vepodiruwa.weebly.com/uploads/1/3/4/3/134374194/5b37174790dc85.pdf
    • http://muwawukiseka.iblogger.org/catholic_church_newsletter_templates.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://788ae96d-7a4f-4726-91a9-07bb742fb3e7.filesusr.com/ugd/97aff7_634e79a79ea640a99d8d10b879a14c7a.pdf?index=true
    • http://beluruke.epizy.com/40558794512.pdf
    • https://b1e6e3cd-24a2-426a-8b7d-e8f4bd81915b.filesusr.com/ugd/83e584_96059bd23c2641fdb8b68e09d2049706.pdf?index=true
    • https://f8ba888e-8f71-4fde-8303-550399648f4e.filesusr.com/ugd/17ce20_b5d8dae5c4024526a3dab98367becb9f.pdf?index=true
    • http://wupenokisu.epizy.com/rockstar_lyrics_free.pdf
    • https://4900ecec-7ac1-411c-be2c-b077674085c8.filesusr.com/ugd/493135_2fa0c4fba65f4851b86150536233b1f8.pdf?index=true
    • http://penabak.epizy.com/sewogijefifexebojenenape.pdf
    • http://zoketuru.epizy.com/60058269117.pdf
    • https://0f285ee0-1b14-49a2-8a3e-060a2db94812.filesusr.com/ugd/4bf67f_b9e0a6ac8de847f481c2781388c750a0.pdf?index=true
    • https://ca6b24e6-01cd-4368-a310-1df05077a315.filesusr.com/ugd/11b39a_f7288be5c3424d62800d5d8262ad0aff.pdf?index=true
    • https://53002a68-e35f-4167-ac88-1ab9777d7e72.filesusr.com/ugd/f5bc2a_cdc670d581bb44baabc8c020f9a8dc18.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002fd79.bin
1be770d8b27a24ebfe5cc35f643a323cebb1f380a12980d9d3d2104cc378db7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FD79 2900 bytes
font_01_sfnt_off000307cf.bin
6e7a846643ba4314fd4aba9e06f615c9ba18947165f1beafee7c5b9be61c7f2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x307CF 5072 bytes
font_02_sfnt_off00031915.bin
c17cbad1b47bcc76edaa3202bc59332fa1344c5b31b97ecb9f07cbc42600ef2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31915 12596 bytes
font_03_sfnt_off0003443c.bin
67cc10ca530bb505f08c6c0dffcd12952087c55f42130ee4896b653fc6e9338f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3443C 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.