Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b0fee75b3a7a1b2…

MALICIOUS

PDF

73.2 KB Created: 2021-03-20 01:59:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 85c6b8f8269a10184b335cbbe8f240b1 SHA-1: b3ce6b3756bcbecc937c98c15d63de1f9efb6600 SHA-256: 7b0fee75b3a7a1b295197c2f0d8f6b2baafdbf9812878dd12994dee12774a17a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL designed to trick the user into downloading further malware. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, appears to reference a 'Skyrim collector's edition guide', likely a lure to encourage clicks on the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=skyrim+collector%2527s+edition+guide PDF link annotation
    • http://copyrights-notices-helps.com/jagumotirubjrs4b.pdfIn PDF document text
    • http://a1metromovers.com/what_filter_for_ridgid_16_gallon_shop_vacagcc7.pdfIn PDF document text
    • http://peludofnor.fun/kakibelkfg2.pdfIn PDF document text
    • http://klosheff.xyz/kewojebunivebavbrypy.pdfIn PDF document text
    • https://cdn.sqhk.co/ludozenidi/1OkhjXm/kifivalutigakixipimikud.pdfIn PDF document text
    • https://cdn.sqhk.co/vutazekerubu/4Wial3k/yeezy_supply_slides_drop_time.pdfIn PDF document text
    • http://micrometerdigital.xyz/vowipiwaxamadisajgrb0z.pdfIn PDF document text
    • https://cdn.sqhk.co/pesunexaxak/hfjgcjb/80391975795.pdfIn PDF document text
    • http://amsidgi.xyz/25215923839gh7s3.pdfIn PDF document text
    • https://cdn.sqhk.co/zogobadakedu/Kig8pji/tatirujepogexufiluturil.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/ba02cdd1-3f79-40d9-b9a3-855be05730ff/how_to_fix_my_samsung_refrigerator_freezer.pdfIn PDF document text
    • https://s3.amazonaws.com/gaxuremewuger/phrases_and_clauses_worksheets_for_grade_5.pdfIn PDF document text
    • https://s3.amazonaws.com/tedowafomaru/36397061203.pdfIn PDF document text
    • https://s3.amazonaws.com/nodetuxapabara/solo_parent_leave_philippines_eligibility.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32e93bce-6730-4bcd-805c-55ffd6032ff9/12428970335.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b2da248-f07f-4fde-8d7b-9eb9025c301e/steam_cleaners_hoover_floormate_deluxe_hard_floor_cleaner_fh40150.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c2a43c6-02a3-4c7a-a48d-ef4a5e01ba92/82239780818.pdfIn PDF document text
    • https://s3.amazonaws.com/xonobijikivo/best_photo_app_android.pdfIn PDF document text
    • https://s3.amazonaws.com/rupatojuko/patalugivujumetofaguma.pdfIn PDF document text
    • https://s3.amazonaws.com/boxujetanonikuv/nuvovo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3AC 5232 bytes
SHA-256: 56437a182dc61e9bbbe43c50b192b1e9ed36401b0fd160226925ef668c70f917
font_01_sfnt_off0000e56b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE56B 10532 bytes
SHA-256: 5897918e8b6fbed94a2f360c86d0de08166851821203a0117cda93de05d6e482
font_02_sfnt_off00010952.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10952 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.