Malicious PDF — malware analysis report

Static analysis result for SHA-256 78de34ce593bbf99…

MALICIOUS

PDF

75.5 KB Created: 2021-06-11 18:03:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe0df1b41098e3dd5fe192f8be01fc93 SHA-1: 79fb24936c812636fe3dd324a69f907c6b82f4b4 SHA-256: 78de34ce593bbf998f08de5429f168b5073466860b158c27057b7bdda17f043d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links and a document body that attempts to trick the user into believing it is a download for a Roblox Arsenal aimbot APK. The presence of numerous external links, including one to allytemp.ru, and a ClamAV detection of 'Pdf.Phishing.Trojan' strongly indicate a phishing or malware distribution scheme. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://allytemp.ru/pbw?utm_term=roblox+arsenal+aimbot+apk
    • https://xilanulutoras.weebly.com/uploads/1/3/4/0/134016814/1386322.pdf
    • https://papilezuserif.weebly.com/uploads/1/3/4/4/134437149/5426766.pdf
    • https://pugojowu.weebly.com/uploads/1/3/4/3/134334477/db74cc356f7.pdf
    • https://jigurojo.weebly.com/uploads/1/3/5/3/135321607/af0c1fd178.pdf
    • https://penikowe.weebly.com/uploads/1/3/4/8/134888725/vasimulupolito.pdf
    • https://zivawopoxiba.weebly.com/uploads/1/3/4/3/134355714/80597ee047286a.pdf
    • https://kuzewejutoba.weebly.com/uploads/1/3/4/3/134398832/jidaxarebamuzoja.pdf
    • https://kebafilononuxo.weebly.com/uploads/1/3/1/3/131378837/rikeruxuweb_zugiw_ginivuzaridukep.pdf
    • https://wilumixomili.weebly.com/uploads/1/3/1/4/131483065/6396736.pdf
    • https://xepesosagar.weebly.com/uploads/1/3/4/7/134737956/4fb9b1d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7a82ace8-556b-4fb0-acea-d86f9d9f151e/jevotipowutut.pdf
    • https://uploads.strikinglycdn.com/files/2753789c-d27a-4393-8879-bcbf6f7c104a/64290928717.pdf
    • http://jananevava.pbworks.com/f/como_pasar_julios_a_kwh.pdf
    • https://uploads.strikinglycdn.com/files/1ed679b8-82a3-4323-891c-a44fe9edfabf/46457210268.pdf
    • https://uploads.strikinglycdn.com/files/1c2a67a3-dda5-46e1-8239-09aaf0497ac6/pubokeju.pdf
    • https://uploads.strikinglycdn.com/files/5ff0c939-5475-4f74-a098-dd418ef88e65/viniwijenefibimaxuw.pdf
    • http://betosaxugawi.pbworks.com/f/1523790887.pdf
    • http://gatasulupu.pbworks.com/f/91979894499.pdf
    • https://uploads.strikinglycdn.com/files/58abf48f-e0be-4064-9cec-d2eafb3e9942/mapigikojoxepi.pdf
    • https://uploads.strikinglycdn.com/files/428bb1eb-8318-48fc-b29f-2192ea8039c7/78983827125.pdf
    • http://jowenoxo.pbworks.com/w/file/fetch/144549090/playstation_3_remote_app_android.pdf
    • https://uploads.strikinglycdn.com/files/00e8f44b-9668-4df4-a245-7a1584d9c78d/midojuronukekufurikates.pdf
    • https://uploads.strikinglycdn.com/files/a91ae67c-780f-48c4-8298-962ddc8c295a/99144714866.pdf
    • https://uploads.strikinglycdn.com/files/82df371d-c732-4a1a-942e-b1a80f54c16f/poganizij.pdf
    • https://uploads.strikinglycdn.com/files/119c5075-ab90-4508-ac01-782c0078bfcb/algebraic_expressions_worksheets_8th_grade_cbse.pdf
    • http://viluxese.pbworks.com/w/file/fetch/144416289/how_to_identify_cation_and_anion.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9ce.bin
48c63fe0c408d328272f3914b5c61d55cc78075508dc6e59f205a62c40ab2651		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9CE 5244 bytes
font_01_sfnt_off0000fb93.bin
00a0a44e0fa5c0926d983cd1759166bc0b3a2a8e895677cd7f744284c32732b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB93 10656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.