Malicious PDF — malware analysis report

Static analysis result for SHA-256 8775bccd28282a46…

MALICIOUS

PDF

87.3 KB Created: 2021-03-17 21:44:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe19d075757a0ce6de01624b661fd969 SHA-1: 96404ed10f8aba5188bec5de545538f191f8bb6a SHA-256: 8775bccd28282a46d116d78ef092c48b682a02f0a6dedcf17eea319d321299e8
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://mezovuduw.ru/wix?keyword=slither.io+apk+ios', which is likely intended to redirect the user to download a malicious application. The presence of a 'download button' heuristic further supports this phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=slither.io+apk+ios
    • https://cdn-cms.f-static.net/uploads/4498834/normal_5fdc89144356d.pdf
    • https://cdn.sqhk.co/sivadapexiri/rDigjoY/kaposoxunakumubame.pdf
    • https://cdn-cms.f-static.net/uploads/4382423/normal_603a602bae7a4.pdf
    • https://cdn.sqhk.co/vitozogog/digha3g/badland_winch_12000.pdf
    • https://cdn.sqhk.co/mekaxosur/8thaPXs/zombies_vs_robots_download.pdf
    • http://rawajajeko.iblogger.org/how_to_remove_icloud_activation_lock_without_password_free.pdf
    • https://cdn.sqhk.co/genizataxom/jidnjgm/3m_post_it_notes_download_freeware.pdf
    • https://cdn.sqhk.co/lasanamemego/hchfjgj/13788253994.pdf
    • https://cdn-cms.f-static.net/uploads/4418570/normal_5fd34f81b6911.pdf
    • https://cdn.sqhk.co/lapitobexeva/IajDzia/here_we_go_round_the_mulberry_bush_film.pdf
    • https://cdn-cms.f-static.net/uploads/4502248/normal_5fd3771371b91.pdf
    • https://cdn.sqhk.co/lanumakefu/mQKr6jb/atom_python_code_formatter.pdf
    • https://cdn.sqhk.co/vinikawikuve/PSOiekC/medopuvareduranofoli.pdf
    • https://cdn.sqhk.co/jodariwem/xmWhagd/pexosesakefi.pdf
    • https://cdn.sqhk.co/riwifesineji/jcc7pz7/dobotepawipumivurej.pdf
    • https://cdn.sqhk.co/zafilivopupu/jcgjOkl/11481381774.pdf
    • https://cdn.sqhk.co/murefazomejo/kegfrTg/trivia_questions_app_ios.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://piludid.epizy.com/statistical_inference_download.pdf
    • https://s3.amazonaws.com/xupizewuxere/51592435704.pdf
    • https://s3.amazonaws.com/wibadinavosunom/orchestral_scores.pdf
    • http://repajazofuwide.epizy.com/teddy_bear_apps.pdf
    • http://gexaforagugozen.rf.gd/ayat_al_ruqyah.pdf
    • http://vugoban.epizy.com/guideposts_writing_contest_2018_winners.pdf
    • https://s3.amazonaws.com/dazinibonofobi/matt_jewellery_design_templates.pdf
    • https://s3.amazonaws.com/sifawekujiki/leine_linde_xhi_861_datasheet.pdf
    • https://s3.amazonaws.com/vavebufevodutob/7891800880.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010326.bin
9c841ade42b6aa6b3138269d4d623da620ffc1c1fce6fc244d5ebf8f91d4814c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10326 5108 bytes
font_01_sfnt_off00011475.bin
5fcd66c25ea86b93932e59162d592ba7dea82c5cfaf9f6e4205c2da4c866889b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11475 11048 bytes
font_02_sfnt_off00013a11.bin
48764e87c02b9a84c146af116970153065bad6898a334da5007f310d7729f136		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A11 16292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.