Malicious PDF — malware analysis report

Static analysis result for SHA-256 882f8d85af68bdab…

MALICIOUS

PDF

88.4 KB Created: 2021-03-18 11:41:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 602f86a758723bb1eaef98c2436456ea SHA-1: 1a2218145c5bb79b2b0efdc79d318580df601047 SHA-256: 882f8d85af68bdabb0a3f80d61e59d729bad385d150f4ed534f433fabb35a168
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to the 'Adventure Island NES game'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=adventure+island+nes+game
    • http://psychologyrelax.xyz/zuziropboj3y.pdf
    • http://zelijek.iblogger.org/koboxatojaravupuzebegi.pdf
    • http://metalllift.ru/conduction_and_convection_gizmo_answer_keyasakf.pdf
    • http://it50off.pro/182971270677qhcn.pdf
    • https://cdn-cms.f-static.net/uploads/4366007/normal_6052f81a3ac9f.pdf
    • http://krepezh.guru/501_synonyms_and_antonyms_answersksidz.pdf
    • http://xofajenakimexo.iblogger.org/76172975364.pdf
    • https://cdn-cms.f-static.net/uploads/4378830/normal_6046feff21a9f.pdf
    • http://berizala.22web.org/best_travel_guides_spain.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8650d040-a33d-467d-a608-6706f181f11b.filesusr.com/ugd/61b8bf_573a0c49be0c4a9286c1e72ca639ab27.pdf?index=true
    • http://vunivaluxok.rf.gd/gallium_arsenide_laser.pdf
    • http://bonagofej.epizy.com/sermon_outline_on_blessed_hope.pdf
    • http://sepazebop.rf.gd/gmail_for_windows_phone.pdf
    • http://nosatezugizixi.epizy.com/zilamudobu.pdf
    • https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_e76526f1f50e4d40a417009bc510537d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6f991ff4-b72a-4dbc-98bb-2c8545f2bb96/statistical_techniques_in_business_and_economics_14th_edition.pdf
    • http://zumijuxuv.epizy.com/jufagepipimoxar.pdf
    • https://4b98dde3-f65d-4e11-807b-d4501949e87b.filesusr.com/ugd/4a7ebd_d0a9b334ef4d457da032446bddc136a0.pdf?index=true
    • http://rejekokamikax.rf.gd/bihar_map_image.pdf
    • https://uploads.strikinglycdn.com/files/c48e6114-a620-4d28-8e63-9f73f7ac4a5d/download_video_asmaul_husna_anak_tk.pdf
    • https://d6d3a1c5-32ce-46e9-ae92-c5b8d84d65d9.filesusr.com/ugd/a3b54b_9642f79bd5cd4228af9fda144e0027dc.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e5728802-1bae-4957-ab01-7301dd1c13c0/pifulur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106b9.bin
56a645d0a5278475c5488635019a11ca6f66c5945d183c20e135e290e3df20c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106B9 6412 bytes
font_01_sfnt_off00011cd2.bin
2312f2b04802760a6c9b16790f6ab139767d4b53d09a46dd631ead1a561b0779		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CD2 5196 bytes
font_02_sfnt_off00012e70.bin
54675aeffaf4c45f4826c645086f72de8082dba2fbc68526e301b0825218f6a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E70 11672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.