Malicious PDF — malware analysis report

Static analysis result for SHA-256 7943348aec83dd31…

MALICIOUS

PDF

75.7 KB Created: 2021-06-09 09:38:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 240eeedc55362ea9071458cf325a7c16 SHA-1: 1e2589e0fe27b8cedaeb702797f3265c9caaacdb SHA-256: 7943348aec83dd31d873ccd92bd6237e3916f4742538caee91288b7769392109
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'inwebjor.ru', which is likely used to deliver a secondary payload or facilitate phishing. The document body, though heavily obfuscated, contains references to 'Suicide Squad apk obb', suggesting a lure to download pirated or malicious software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=suicide+squad+apk+obb
    • https://cdn-cms.f-static.net/uploads/4443602/normal_60417fca08062.pdf
    • https://cdn-cms.f-static.net/uploads/4369762/normal_60475aeecaaad.pdf
    • https://static.s123-cdn-static.com/uploads/4454171/normal_5fcd8339e2f48.pdf
    • https://cdn-cms.f-static.net/uploads/4393521/normal_5fd274398fd90.pdf
    • https://cdn-cms.f-static.net/uploads/4371509/normal_5fd6ffd1f2318.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/770309b7-9888-4b74-82b9-3637960ba45e/manual_para_tocar_guitarra_rock_blues.pdf
    • http://joxakuruvi.pbworks.com/f/45955661742.pdf
    • http://zanonot.pbworks.com/w/file/fetch/144903564/waganewubatonamejowet.pdf
    • https://uploads.strikinglycdn.com/files/5059ab4d-14fc-4b5a-85f5-d261dce8df75/kaxusumesigafuxodefa.pdf
    • http://biwonuv.pbworks.com/w/file/fetch/144471954/how_to_put_together_a_skorva_ikea_bed.pdf
    • https://uploads.strikinglycdn.com/files/a476a03e-7578-4e88-8e32-82fd76e4507e/what_is_the_dramatic_irony_of_the_poppet_in_the_crucible.pdf
    • https://uploads.strikinglycdn.com/files/c4329216-306e-4ab3-986b-d07384ffecba/the_fisherman_and_the_jinni_full_story.pdf
    • http://gutupum.pbworks.com/f/rainbow_six_siege_alpha_pack_charm.pdf
    • http://gapufipi.pbworks.com/w/file/fetch/144657354/busenufapujapetewoj.pdf
    • http://doxawadar.pbworks.com/f/22884436405.pdf
    • https://uploads.strikinglycdn.com/files/f55e5a24-a892-4618-9ce5-187a5448000d/27894254190.pdf
    • http://wirabofitox.pbworks.com/f/52775206589.pdf
    • https://uploads.strikinglycdn.com/files/36ae3760-6d09-4d26-9e89-5edbd6f5069b/how_to_get_court_marriage_in_india.pdf
    • https://uploads.strikinglycdn.com/files/553d80b8-3f62-4154-a62f-19d5554a4bf4/sunbeam_bread_maker_5891.pdf
    • https://uploads.strikinglycdn.com/files/04373c55-4de8-40a7-9fb1-e64678a492d5/micro_expressions_training_app.pdf
    • https://uploads.strikinglycdn.com/files/c903aba1-eb45-4b16-8aa9-26ddc25b5ca9/what_causes_red_spots_on_your_eyeball.pdf
    • http://sukagafamo.pbworks.com/f/ejercicios_resueltos_sistemas_de_ecuaciones_lineales_3x3.pdf
    • https://uploads.strikinglycdn.com/files/186c0b89-f0cc-4b8d-8f16-a1462ae66b69/nipegor.pdf
    • http://gugatodoka.pbworks.com/f/t_shirt_design_template_psd_free_download.pdf
    • https://uploads.strikinglycdn.com/files/bc1e6eca-aa17-4760-a5b9-8c8cd3b14b31/how_many_carbs_are_in_a_burrito_supreme.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e90f.bin
80e394f25a95c8a721099bfdd141f34f7f05d0726805c72e649d0ad14e55729b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE90F 5372 bytes
font_01_sfnt_off0000fb65.bin
50a3b86a280dd3adb85ed1b02f8504afc14ca97274738c14d048a2c56c101f7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB65 11164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.