Malicious PDF — malware analysis report

Static analysis result for SHA-256 70dcce8ef2eda4e8…

MALICIOUS

PDF

80.4 KB Created: 2021-06-13 15:11:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 251b1e461fad2c4e7947f289456ecc38 SHA-1: 930af18e2cfa37f3c6269134c1fa2b87f5778d10 SHA-256: 70dcce8ef2eda4e80b3281f421f2154344d7d8ef13052ed9c98bad21647ee503
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. The document body, though heavily obfuscated, contains text related to 'how to get cs go knives', likely a lure to entice users to click the embedded malicious URL. This URL, 'https://infrive.ru/pbw?utm_term=how+to+get+cs+go+knives', is the primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=how+to+get+cs+go+knives
    • https://safalijig.weebly.com/uploads/1/3/1/0/131070993/rixenirej_zelekasaxewekiv_derade_jopovuxenawu.pdf
    • https://cdn-cms.f-static.net/uploads/4390057/normal_606b43bcbff39.pdf
    • https://nozodipipagim.weebly.com/uploads/1/3/1/4/131438171/52480365905047e.pdf
    • https://wigabededonekan.weebly.com/uploads/1/3/0/7/130740374/xipatinirubofi.pdf
    • https://cdn-cms.f-static.net/uploads/4420766/normal_5fd6602bb7816.pdf
    • https://static.s123-cdn-static.com/uploads/4388629/normal_5fe14c77b53bd.pdf
    • https://static.s123-cdn-static.com/uploads/4378378/normal_5feb9a87893dd.pdf
    • https://cdn-cms.f-static.net/uploads/4461777/normal_60c57b61408e2.pdf
    • https://cdn-cms.f-static.net/uploads/4480182/normal_6051be8399556.pdf
    • https://cdn-cms.f-static.net/uploads/4419236/normal_60449fa9e3607.pdf
    • https://static.s123-cdn-static-d.com/uploads/4502817/normal_60b103e7baf43.pdf
    • https://fejavuwuvumago.weebly.com/uploads/1/3/0/8/130874007/4375529.pdf
    • https://cdn-cms.f-static.net/uploads/4462351/normal_603eb312eb851.pdf
    • https://static.s123-cdn-static.com/uploads/4384149/normal_5fcce14f62a93.pdf
    • https://faxakitowe.weebly.com/uploads/1/3/1/4/131437357/zekilevuwivufosip.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/9a521182-7300-432d-838c-8379d38b2271/pillars_of_eternity_2_strategy_guide_download.pdf
    • https://uploads.strikinglycdn.com/files/1d47e388-89cc-4a06-ba22-cb4a8c6eda77/dibujos_de_caritas_de_nios_felices_y_tristes.pdf
    • http://wozixokumo.pbworks.com/w/file/fetch/145022925/emotional_intelligence_daniel_goleman_free_download.pdf
    • http://lomubel.pbworks.com/f/tom_and_jerry_the_midnight_snack_1941.pdf
    • http://lulatigono.pbworks.com/w/file/fetch/144537705/gafilagojimonizar.pdf
    • http://zuguwar.pbworks.com/f/how_long_to_get_mortgage_pre_approval_letter.pdf
    • http://jitilabajeko.pbworks.com/f/how_to_install_minecraft_comes_alive_on_ipad.pdf
    • https://uploads.strikinglycdn.com/files/c4cbce55-ff19-48e6-9d6c-48531bf11372/contrato_de_arrendamiento_local_comercial_sencillo.pdf
    • http://pafesudive.pbworks.com/f/71127788138.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef8e.bin
a464ba66085a62a7871b9a2a8fd0667fd8596844b25bc0f841997d99a70dd346		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF8E 4596 bytes
font_01_sfnt_off0000ff5c.bin
58524071e6d5f9c65803cdfa91a8f898b803c2bcd22ec31d2666e1ee4c0214ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF5C 11216 bytes
font_02_sfnt_off0001257c.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1257C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.