Malicious PDF — malware analysis report

Static analysis result for SHA-256 78f4c787d0d025e1…

MALICIOUS

PDF

74.5 KB Created: 2021-04-03 15:36:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0e9c6e8a46b90310070a4a46dc4257f3 SHA-1: 14e551ad2e25238ccd88f1af357c08b62b9d7cd4 SHA-256: 78f4c787d0d025e1881e1af005e711abb8c2a16f5498ac7e2884a97940d2057b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that directs users to a website offering a 'free fortnite account generator'. This, combined with the ClamAV detection and ML classifier flagging, strongly suggests a phishing or scam attempt. While no scripts were explicitly extracted, the PDF structure and embedded URI are indicative of malicious intent, likely to redirect users to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=free+fortnite+account+generator+2020
    • http://mjawebdesign.net/fedidolinojexapoziwebi5i6qy.pdf
    • http://lekanevakima.iblogger.org/how_to_calculate_thermal_efficiency_of_an_engine.pdf
    • http://xulubapatoso.scienceontheweb.net/gatekapivoned.pdf
    • https://topizamo.weebly.com/uploads/1/3/4/4/134435864/fe490d2.pdf
    • http://luxasireku.sportsontheweb.net/norelco_multigroom_5000_vs_7000.pdf
    • http://pofuxubilet.sportsontheweb.net/nazagevojaset.pdf
    • http://sudejiw.22web.org/tonetogude.pdf
    • http://elinekici.online/how_to_start_craftsman_air_compressor7dnwu.pdf
    • http://stakingyfi.com/tamesixugubuwakaguvo2fi6s.pdf
    • https://sorefumegevori.weebly.com/uploads/1/3/1/8/131871670/ruviduzipawaku-libaxi.pdf
    • http://bezugunafagomup.22web.org/safety_management_system_aviation.pdf
    • https://lefagetali.weebly.com/uploads/1/3/2/3/132302894/nazidaju-kawefa-jovakezatilosu.pdf
    • https://refanise.weebly.com/uploads/1/3/5/3/135389799/divoginik.pdf
    • http://lexaxak.mywebcommunity.org/fifadenivuxivukiw.pdf
    • https://vifutezovabul.weebly.com/uploads/1/3/1/4/131408528/surateride-zekupaxegamonit-puzojilinam-mejupunivumufiw.pdf
    • http://itdiscount.info/monster_hunter_world_hunting_horn_guideawdd6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://fuguzametekobo.myartsonline.com/xezagop.pdf
    • https://s3.amazonaws.com/pobixedele/sepsis_trust_guidelines.pdf
    • https://s3.amazonaws.com/taturi/zibug.pdf
    • http://domebiwek.myartsonline.com/elementary_calculus.pdf
    • https://s3.amazonaws.com/degisapemifa/junazuvezelubelobav.pdf
    • http://folixuk.rf.gd/pizirawunorunafozajuwupan.pdf
    • http://jugixumob.rf.gd/31732297543.pdf
    • http://zesugipove.onlinewebshop.net/zufifuwekufituninakara.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2d2.bin
dc6a387fb8dffc52423a85d3ad21fdf29d6ef71ef0055684f4e080c3cfd0def7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2D2 4952 bytes
font_01_sfnt_off0000e3ae.bin
d986bc4f9bc36c17e04f2cc7da5a5b1ef1ed396aedebfb8118b1389354925da6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3AE 2080 bytes
font_02_sfnt_off0000ed45.bin
8bec80427a95efab0fff12b6c391f99673f1f251a39793dce252d47bf06563a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED45 9484 bytes
font_03_sfnt_off00010dd6.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DD6 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.