Malicious PDF — malware analysis report

Static analysis result for SHA-256 68e168dec328e7ea…

MALICIOUS

PDF

88.1 KB Created: 2021-03-07 02:50:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 378f24e2486d0d9b7c1e8df88e0767dd SHA-1: 23d8dee6f3a28f88c26d044320de241e047c8454 SHA-256: 68e168dec328e7ea017e09f81d1bc72bf29b0229032033a1e9d98a5dafbaa2ad
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with the primary one being 'https://leonvi.ru/wix?keyword=nba+jam+download+apkpure', suggesting a lure to download content. While no scripts were explicitly extracted, the presence of external links and the nature of the detection indicate an attempt to trick the user into downloading a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9966

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=nba+jam+download+apkpure
    • https://dofuzubakav.weebly.com/uploads/1/3/1/6/131606612/3612931.pdf
    • https://cdn.sqhk.co/dofexoxev/uwhdjdK/likert_scale_definition_statistics.pdf
    • http://vitalia-transports.com/279452496321s99g.pdf
    • https://cdn.sqhk.co/gajerivab/jerhigh/poweramp_v3_skin_gold.pdf
    • http://helplnstagramcontact6088756.com/anubis_mask_templatesz8r1.pdf
    • https://luperexazim.weebly.com/uploads/1/3/6/0/136094329/2419843.pdf
    • http://eagleaff.com/cost_of_living_comparison_worldwide1jmfq.pdf
    • http://samoe-samaya.ru/mercury_110_9.8_recoil_startervohjc.pdf
    • https://cdn-cms.f-static.net/uploads/4445726/normal_601a881f23d93.pdf
    • https://cdn.sqhk.co/xegunorasu/ichbTid/doloporepoda.pdf
    • https://static.s123-cdn-static.com/uploads/4419827/normal_6003dcc06d1f0.pdf
    • https://vawudida.weebly.com/uploads/1/3/4/8/134890241/nolegunisopuwep-rusalibugowabes-xewalapo-sirokevubanawu.pdf
    • https://cdn.sqhk.co/kupawusel/xEidjgl/xenokalujug.pdf
    • http://bizowokare.getenjoyment.net/47352110323.pdf
    • http://money-team.site/303210852878w952.pdf
    • https://suletakawuzumab.weebly.com/uploads/1/3/5/3/135348492/937731.pdf
    • https://static.s123-cdn-static.com/uploads/4455884/normal_5fc96b9f0d28f.pdf
    • https://cdn.sqhk.co/dolavalof/i8pf5kU/kimum.pdf
    • https://xonujofepip.weebly.com/uploads/1/3/4/3/134385468/8588642.pdf
    • http://zenajok.medianewsonline.com/monster_hunter_trailer_2020_deutsch.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/3850052d-ed5f-4e99-a6a9-a41ba1e22921/does_time_capsule_work_as_a_router.pdf
    • https://uploads.strikinglycdn.com/files/c48529e0-878a-4b7b-814f-ca597e8d33c8/how_to_fix_basic_computer_problems.pdf
    • https://uploads.strikinglycdn.com/files/e865541c-e685-4e48-b2cf-c910544d392b/gagane.pdf
    • https://uploads.strikinglycdn.com/files/eb71fa2f-8bbb-4cea-b57d-a70a90f36b6c/18994278798.pdf
    • https://uploads.strikinglycdn.com/files/a09d26bf-4c6d-45e0-8f86-5c6cfc3cfa79/kovulegugufopajawizeboguz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f301.bin
01f6a4499250d6be311d4cbe2353be296d94720ba2555885e6e9060fe70355a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF301 5268 bytes
font_01_sfnt_off000104e2.bin
51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104E2 1800 bytes
font_02_sfnt_off00010d70.bin
ee6e6f730fcaba45db3aa0fc7d1417f5bb5135c68f1c7ee465cb2c87393e8724		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D70 10472 bytes
font_03_sfnt_off0001317c.bin
bf8f9ece8d9d74ce2d7a98a07ee1bb8f4056faf702b3b1702118181e85f1b939		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1317C 16312 bytes
font_04_sfnt_off00014743.bin
49736c7f3cce009c5013dcb32c5ef6d35f991ef48a8fdc363f760cc517610df8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14743 2836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.