Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b50329e3d461d43…

MALICIOUS

PDF

92.1 KB Created: 2021-03-14 12:48:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 545df91b64560e2b5ef25c96192c95a4 SHA-1: 80f3013ee13b93cde85d72ecefeb3372f057cf8a SHA-256: 8b50329e3d461d437a41ca8bbe3ff2d520fa3b5ce1e0108e398b9f63330539ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL. The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded URL likely leads to a phishing or malware distribution site, disguised as a manual for an Android TV box.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=android+tv+box+cs918+manual
    • http://sitizinudex.getenjoyment.net/vba_excel_notes.pdf
    • http://xenuven.22web.org/32442569811.pdf
    • http://kiladuwujufuzav.22web.org/la_casa_de_los_espiritus_pelcula_sinopsis.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zudupaxub.myartsonline.com/63920418379.pdf
    • http://nogigekeweragu.rf.gd/sotibirojezunojemu.pdf
    • https://34ea5197-a9e9-4ba5-99bb-a7dd7aeba98b.filesusr.com/ugd/234f58_bc72d630b2bc440b9bfb9499e57e5c95.pdf?index=true
    • https://s3.amazonaws.com/zifozujiwi/purulavoxupababeni.pdf
    • http://lakiver.epizy.com/coral_kemuel_faa_morada.pdf
    • http://sedekebokavid.rf.gd/stephen_king_the_dark_tower_7.pdf
    • https://2cc3dcad-61c1-4442-8662-ca5be7cd8672.filesusr.com/ugd/71b93f_c67f661436094ae9b96876a72d14882b.pdf?index=true
    • http://kubemumibesedu.epizy.com/jolosofiwufemarig.pdf
    • http://bejiteviv.epizy.com/cabal_online_blader_guide_2018.pdf
    • http://watokugen.epizy.com/chevy_cruze_2013_lt_manual.pdf
    • https://91313464-3f42-441e-b0e8-b27065d471ad.filesusr.com/ugd/ee9d3f_4fe0856fc6cd480482921fa36ccdd54c.pdf?index=true
    • http://novotufimaxanu.epizy.com/ariston_oversink_water_heater_3kw_30ltr_manual.pdf
    • https://s3.amazonaws.com/jenagubadopi/bogglesworld_science_worksheets.pdf
    • https://s3.amazonaws.com/zarusegibitumet/adobe_photoshop_7_tutorial_free_download.pdf
    • http://veluvuwipigunuw.rf.gd/bozupuwizoxitikivuxerud.pdf
    • https://54179944-c6a3-49b3-9462-5d1939b6aff2.filesusr.com/ugd/49f5ef_9139d984f83b498ea11c584a2f17a985.pdf?index=true
    • https://s3.amazonaws.com/zusevamasor/simple_harmonic_motion_and_springs_worksheet_answers.pdf
    • https://de7eff9d-5c50-4122-bb99-ee112abf7a8f.filesusr.com/ugd/db8f21_0c2438a50021401a9b0c56408e83ff65.pdf?index=true
    • http://maguvunu.epizy.com/how_much_is_boston_market_turkey_dinner.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001048c.bin
cd57db975b2de555caa90a3eb766125b6dfef5270eae33dddbb243686263b1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1048C 3236 bytes
font_01_sfnt_off00011002.bin
13dc36e38575f8d3b5654cea5522ea6fd151c08d6850a75eb41794c8899a43f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11002 5744 bytes
font_02_sfnt_off0001237e.bin
7c689b4b63b96c4b79318c626d020c9c5cf7cbff230a077721724b55e0259525		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1237E 11812 bytes
font_03_sfnt_off00014bd2.bin
503f5200e83b189a546b6c6e1d808633a9135186956fe76ff9bd78de3d91e3c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BD2 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.