Malicious PDF — malware analysis report

Static analysis result for SHA-256 89a33e144e0caac9…

MALICIOUS

PDF

81.9 KB Created: 2021-03-17 22:55:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: d054316b94af398307dfd6a9e423b2dd SHA-1: 7890c39cc19ef0d24bf86329a6d7b9bf55de70c6 SHA-256: 89a33e144e0caac930e7fe9eefecf33e0817fd87510ded95f06be6f2ec5345ea
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with one prominent URL pointing to a site offering 'unlimited gems' for Clash Royale, a common lure for downloading malware. The PDF structure and embedded content suggest it's designed to exploit user interest in game cheats to deliver a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=unlimited+gems+clash+royale+apk PDF link annotation
    • http://vodoroding.info/anti_school_uniforms_argumentss70cj.pdfIn PDF document text
    • http://furniture21.online/dance_music_videos_for_toddlers5hbpd.pdfIn PDF document text
    • http://sitebomobegux.sportsontheweb.net/xewasunoxa.pdfIn PDF document text
    • http://3-bureaureport.info/lekasegevifemefusijaxc0i5q.pdfIn PDF document text
    • http://girlita.space/rosalina_and_luma_guide_smash_ultimateupfw4.pdfIn PDF document text
    • http://tafugegajotu.mygamesonline.org/46992766012.pdfIn PDF document text
    • http://tujemet.scienceontheweb.net/morasijimon.pdfIn PDF document text
    • http://sagedix.medianewsonline.com/darrieus_vertical_axis_wind_turbine.pdfIn PDF document text
    • http://kafalukuwemi.mygamesonline.org/technical_writing_course_curriculum.pdfIn PDF document text
    • http://bulakirip.getenjoyment.net/dark_tower_series_in_reading_order.pdfIn PDF document text
    • http://sawemawe.mywebcommunity.org/infringement_of_patent_and_legal_remedies.pdfIn PDF document text
    • http://wivuperafuzo.mypressonline.com/analytical_reasoning_questions_with_solutions_for_gat_general.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a16ba774-bdf8-4d71-9595-16bf32abbbb2/75584477879.pdfIn PDF document text
    • https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_d33efa3a6afd4e3dac43be148ee471b0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/207ac94e-17a5-4afa-af51-0e6e9be15b67/33000706858.pdfIn PDF document text
    • https://95e354e6-8561-4e52-807b-deb85f3b5fdd.filesusr.com/ugd/ca9b0a_debaa28d929244a39c7c94ba2fc9c9d6.pdf?index=trueIn PDF document text
    • https://fe426b01-1dd0-498a-b08e-7ec37e320b94.filesusr.com/ugd/6b45f0_5f4dc0daa9fd4a248c9c04aad7050272.pdf?index=trueIn PDF document text
    • https://5db246a0-94da-4013-9f64-c970003367b9.filesusr.com/ugd/ca5179_e8e9bc0a49524afb99eb58eb14b4ee50.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/22153120-8cfd-411c-bcbe-bf73980fd28d/segodufiji.pdfIn PDF document text
    • http://tofalit.myartsonline.com/jumisupojeniru.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93384fbd-197e-49a6-b3f5-3577bf214de9/sketchup_free_vs_shop_vs_pro.pdfIn PDF document text
    • https://ee6bc897-aa08-459d-b6e6-b1b1d69fcba1.filesusr.com/ugd/7ba596_8ba0d0eea6f34ad99d70b085ef670e01.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/61e5df53-fa76-4182-ad3e-eb0827a6446b/kinodofivejexete.pdfIn PDF document text
    • https://c33c3ce4-fa2f-4f19-9477-7a801b41b29e.filesusr.com/ugd/ebbcbd_6c72a58dcc1f419f9646f4868de8151b.pdf?index=trueIn PDF document text
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_14e0e213f647465c97097b5142eb0458.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001011c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1011C 5644 bytes
SHA-256: 71e78ec82c65bb97ea65ddbd9b049e5daeb24938901a02e2f046e0e8d4f4ec28
font_01_sfnt_off0001142f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1142F 11336 bytes
SHA-256: 9e1ac158d67fd42ac265d96d37f65a587593cba90c553a20e705613e407593df