Malicious PDF — malware analysis report

Static analysis result for SHA-256 764979aa449b1699…

MALICIOUS

PDF

77.4 KB Created: 2021-04-01 13:40:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e047409b08f2c81623dbfa7b2d34938a SHA-1: 853e8614d16e53255397145101fa0f790360ed58 SHA-256: 764979aa449b16991003558dba188fe9ba153287c0eed61d468b8894e5a71e90
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. The embedded URL and document body suggest a lure for downloading an application, likely a trojan or malware. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a phishing or trojan distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=shadowgun+legends+apk+download
    • http://budokudepa.scienceontheweb.net/depazoge.pdf
    • http://lifeeuro.info/921770963565yo.pdf
    • http://covid-19online.site/282332102697185p.pdf
    • https://cdn.sqhk.co/raxuzuvuluf/iajLykK/finawakudoti.pdf
    • http://bopugafuwu.scienceontheweb.net/arabic_urdu_dictionary_download.pdf
    • http://meetcabinets.xyz/bixepisizir0yfmt.pdf
    • http://setokanekema.mygamesonline.org/review_mares_puck_pro.pdf
    • https://cdn.sqhk.co/wazikunal/haL7Q1m/22929061390.pdf
    • http://artdebug.site/53140917310npc6c.pdf
    • http://raguvigawak.mypressonline.com/bahra_cable_catalog.pdf
    • http://naturebiolog.space/dibujos_de_caras_faciles_a_lapize1dhg.pdf
    • https://cdn.sqhk.co/vemudumuxixu/VgitLgj/galaxy_cinema_carson_city_nv.pdf
    • https://cdn.sqhk.co/vetelojid/jdgdiax/94192863324.pdf
    • http://it50life.pro/canon_speedlite_430ex_ii_flash_remote_trigger5wh1t.pdf
    • http://ecoservice-vlad.ru/terogofafxd4sh.pdf
    • http://pelistens.xyz/how_to_control_tv_with_iphonee4rh1.pdf
    • https://cdn.sqhk.co/gebitasixa/jjKMwge/zombie_castaways_toys_island_walkthrough.pdf
    • http://dibiwarisogix.mygamesonline.org/20443957655.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://78bdfa25-736e-4945-a764-db21511aacb9.filesusr.com/ugd/9bd82e_1b19b10b86574c1f840ce0f271605706.pdf?index=true
    • https://4253c66a-660d-4c83-b31d-f715833d547b.filesusr.com/ugd/d9e9a0_f8d15e20afd5434a8b04e2c1f50bfaca.pdf?index=true
    • https://6cdf8c5e-36a0-4b6d-987f-32d3d50030cd.filesusr.com/ugd/3c2e2e_d16b3e8a004242628b34e3ac7a733fea.pdf?index=true
    • https://36425c1f-c329-48aa-845d-1f8252cb45c8.filesusr.com/ugd/01d500_c509aaa0ed624b5ba7e8d100315575b8.pdf?index=true
    • https://631ffb88-cf2d-4844-8d6b-9338a1b21cc5.filesusr.com/ugd/d24e6f_279472cacce4443abf19c8a55b55c371.pdf?index=true
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_a723a34bbd7b4643b411a86a61825a58.pdf?index=true
    • https://34ea5197-a9e9-4ba5-99bb-a7dd7aeba98b.filesusr.com/ugd/234f58_b2cd680b9b354531ab90bad3b452eb72.pdf?index=true
    • https://92923600-264c-4cb8-9d87-181083d4f0d6.filesusr.com/ugd/0bf43f_9d9e45687ba74046861cfd18ae55a3c5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e425.bin
2eb714b96f536715b1e5de0ea66f226f2da21be45652d45109303a33ca3b85ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE425 5384 bytes
font_01_sfnt_off0000f685.bin
c5e10e6bfa0c23adba64b90556d49de9d870e6b2062eb2235d6247ca117d960a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF685 21980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.