Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e6c7508b80616e4…

MALICIOUS

PDF

70.7 KB Created: 2021-05-18 02:01:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe34a7e569ab00b3d6cbd548c15ffba9 SHA-1: 2035e69bd3ef1e71cea157a7b07273b1d2f06bf7 SHA-256: 8e6c7508b80616e41a8bc89ef56467899ffaac4e38ee7a44ec5d28e1d5d0eb0d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The document body, though heavily obfuscated, contains references to 'Brawl stars hack apk download', suggesting a lure for users seeking game cheats. The presence of numerous embedded URLs, many pointing to PDF files hosted on various websites, indicates a potential distribution network for this malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tcufroghouses.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085f620dedd3---83391006986.pdf
    • https://archcosmeticstudio.com.au/wp-content/plugins/super-forms/uploads/php/files/92fecf9b5fc6bb5a995169d5df4b2060/jumijibejoloz.pdf
    • https://catherinehourihan.art/wp-content/plugins/super-forms/uploads/php/files/60763df4aecbc2359765efd18d89175f/48682800072.pdf
    • http://asfalon.com/__files/file/47930154551.pdf
    • https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160786d76a7911---54613297428.pdf
    • http://www.fsnn.se/wp-content/plugins/formcraft/file-upload/server/content/files/1609d2b715ec38---fesolesogikezane.pdf
    • https://www.xcelsus.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608889f890d32---jozabasominusabomes.pdf
    • https://dedywiredja.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607658e1efa0c---vuwoxaki.pdf
    • https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/1607756abc9a0a---busilesoxitetusadu.pdf
    • https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/c3a86ba8267eeb92cb00673c19e2ec9e/8787533414.pdf
    • https://www.hausbootgeiseltalsee.de/wp-content/plugins/super-forms/uploads/php/files/0mndddmkv5s524hh8s53fs1aqe/potetatafubutukefetajo.pdf
    • https://cspdental.com/wp-content/plugins/super-forms/uploads/php/files/b40f213dc2449b9f4357e023807b43d6/kinuwot.pdf
    • https://ethiquedevelopers.com/wp-content/plugins/super-forms/uploads/php/files/b6c2f4e6ae13ffcddfb15c1e6113c99f/kavatibubokok.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=brawl+stars+hack+apk+download+2019+ios
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3fd.bin
c8c5c75f5fcffe25bb507127ded79d983acff632061a9394f962d234d2f3092b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3FD 5848 bytes
font_01_sfnt_off0000e7f3.bin
752636395681aec77ccf9ffbd0d5d713b839667b9222993a5514719090857a2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7F3 10692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.