Malicious PDF — malware analysis report

Static analysis result for SHA-256 822dd0ca31ec669d…

MALICIOUS

PDF

84.6 KB Created: 2021-05-22 10:27:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 2de46ce75a83e49aff049d94786e72d0 SHA-1: bf1632ef2ab833c266fa9b391c8b9e5228d95ec5 SHA-256: 822dd0ca31ec669d49b87c44a7198629745790cb2f435a66db506e4e974d70d4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting it is used for phishing or to download a secondary payload. The document body, though heavily obfuscated, contains references to 'Subway surfers cheat codes' and 'wkhtmltopdf', indicating a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=subway+surfers+cheat+codes PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4464852/normal_605ac5eb61435.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464541/normal_604a84da1c190.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379369/normal_5fe1ba80cc348.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417526/normal_5ffc94aee572f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370266/normal_5ff19256346cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450746/normal_60354c3537e84.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367646/normal_5ffba5e74f207.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476941/normal_604f41f752a4b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xuzed/4076068838.pdfIn PDF document text
    • https://s3.amazonaws.com/rokuwapesu/lakshmi_narasimha_swamy_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/vipuxafol/discovery_school_newcastle_ofsted_report.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/demon_souls_mage_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/lolijexejomak/histrionic_personality_disorder_scale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96e0c232-1930-4c34-a8dd-11e6c0443218/10988184157.pdfIn PDF document text
    • https://s3.amazonaws.com/nademopor/solitaire_card_game_for_windows_7.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2fc20e2f-a206-4c11-9e73-ccff3d8386b3/60990464958.pdfIn PDF document text
    • https://s3.amazonaws.com/resisuna/indian_movies_app.pdfIn PDF document text
    • https://s3.amazonaws.com/wekibik/25381856961.pdfIn PDF document text
    • https://s3.amazonaws.com/kakef/67325940199.pdfIn PDF document text
    • https://s3.amazonaws.com/ninasivol/roruj.pdfIn PDF document text
    • https://s3.amazonaws.com/dufekifaral/gogerasukelafof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/065489e5-3065-4373-8f97-135dfca9f65f/homelite_xl_12_fuel_line_replacement.pdfIn PDF document text
    • https://s3.amazonaws.com/kawotexulozax/61303253661.pdfIn PDF document text
    • https://s3.amazonaws.com/wixamupelinere/zagif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e66ce2a-00d9-4efd-879b-d187fe3d0cb6/tusupujoludefirevi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f69c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF69C 5516 bytes
SHA-256: 9533fb51d4f32aafd733ecc2f6c8479068ebdc5655024760fdeedfe9c5879f02
font_01_sfnt_off0001096e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1096E 11004 bytes
SHA-256: e2ff6cc463495a94dc1428f9b4522737d076f7978d57cf1f0fa2352652821e0f
font_02_sfnt_off00012f1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F1F 16156 bytes
SHA-256: 5a9def117e36ec4689c51e255f2d3be797417540c4b2c82071319991e034b19c

Open this report in the interactive analyzer, or submit your own file for analysis.