Malicious PDF — malware analysis report

Static analysis result for SHA-256 88d723aece11ab6d…

MALICIOUS

PDF

81.6 KB Created: 2021-03-11 17:14:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: b16fd599d060e03df70c9528fc576ab5 SHA-1: 4b30c970c5b7a403f5f3a31ccab8afc02725ce8b SHA-256: 88d723aece11ab6d8fc520d60124eb4a9d0e2d1a43c12121f7a98b289899e27d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to 'Hunger games pdf file free download' and the wkhtmltopdf application, suggesting a lure. An external URI pointing to 'dugedepap.ru' was extracted, which is likely the malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=hunger+games+pdf+file+free+download PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1cb65d53-0ab0-4dfc-83c3-2f7c16ec5b77/definition_in_reading_and_writing_skills.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb64d28a-2f71-4e44-b526-3a2437991007/zilabutumise.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/034fd905-a745-415e-aff1-f8f7460104e6/beatles_sheet_music_for_piano.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e01a7c1-fc60-4dcb-887e-574dc7f27ff1/how_to_repair_blown_vizio_subwoofer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/663a6df6-3c48-4ea7-93be-76b71e997f3a/32126813316.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6cf2f3e1-fa30-4ef3-bcac-d43977a7e289/41101682027.pdfIn PDF document text
    • https://s3.amazonaws.com/minegikukovel/bts_album_answer_version_l.pdfIn PDF document text
    • https://s3.amazonaws.com/dowavelaxam/nejesoxezifan.pdfIn PDF document text
    • https://s3.amazonaws.com/zifilobesumafi/46318159910.pdfIn PDF document text
    • https://s3.amazonaws.com/savukojubusum/rampage_ruins_ctr_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/gomaxod/26009756636.pdfIn PDF document text
    • https://s3.amazonaws.com/wibedubosateg/50_shades_of_grey_cast_drama.pdfIn PDF document text
    • https://s3.amazonaws.com/tibanepoxilibud/65855192702.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc3be7e6-f095-43fe-9a7a-2de3dab76e25/what_are_the_zeros_in_a_polynomial_function.pdfIn PDF document text
    • https://s3.amazonaws.com/jazamerijekufol/how_to_beast_workout_routine.pdfIn PDF document text
    • https://s3.amazonaws.com/boxalewijim/astha_bangla_natok_song.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/560bb7a4-16ee-4bb0-b7c8-56ee19a702f5/92710789673.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/807245b2-c652-4b55-b65c-7d1d8e3d71c9/dbt_skills_training_manual_linehan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75135c4b-e7d3-42d1-aa41-0a96bad3d6a1/the_missing_imdb_season_10.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/221ef485-21e6-4b56-85d9-72eeafcbb6dd/dogorexukalifadewol.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102D7 5416 bytes
SHA-256: dd935a54638e30b9ee593b2e5eac8d0ed113eaee51901b52dda3f6d43d5e4c34
font_01_sfnt_off00011541.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11541 10448 bytes
SHA-256: eb4f4a4a6cf2e35175498348284a5f425a08c9738bd30f5843d08339b397b8e1

Open this report in the interactive analyzer, or submit your own file for analysis.