Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f88c2230208a488…

MALICIOUS

PDF

84.9 KB Created: 2021-05-27 16:03:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 4cb3326b614ffa40fa5da497419e5bb6 SHA-1: e571ee0fca047f2d805a57749a1720b7de42e94c SHA-256: 8f88c2230208a488d5b900ce9fcb9075b48abce25bc9a47cf0db53a88524990e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a site offering a 'corrupted video file repair apk'. This is a common social engineering tactic to trick users into downloading and executing malicious files. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=corrupted+video+file+repair+apk PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4392868/normal_60391de7bbba7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380682/normal_5fdd35f32fa57.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464521/normal_604b85094aaec.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459941/normal_5fc571188c625.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459921/normal_5ff8ff2fba8bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484999/normal_602c5974ad5b4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423166/normal_5fe6374611b33.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486192/normal_5fd715e649ae4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484805/normal_604d1f5f96c86.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c4d394e2-706c-4fc2-810b-a48d9fe43f87/79275900621.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf9b0ae0-7f1c-429d-9f9b-0259a07f2028/93400932572.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae38aa94-8cf7-418e-8203-af81c25cedad/what_causes_decreased_bowel_movements.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/203c9997-f605-4b2d-b69b-e6ff6eb4ef2f/59524884967.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3c80c5d-00b3-48de-b9e1-15e28e6d47af/vijusexijezinuwikugewuk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf059379-af33-4e5f-9422-411aff72a99c/jasezosunuzetufitajemoba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f19e2d18-c99c-4821-b284-69d89cf007b1/trombone_slide_position_chart_treble_clef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/033d5579-baf1-471f-99a7-1a1043330941/lusuwonivokomupebu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6110c438-17af-4804-b898-4b441593f1ac/where_is_the_reset_button_on_oil_furnace.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010eae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EAE 4884 bytes
SHA-256: e6277cd862f2806a523f2bf30dd44b95cf9abd57c99eecbea65241124633a349
font_01_sfnt_off00011f62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F62 11500 bytes
SHA-256: fda3d2d47e9874f2a2dabb1ddb3a3dcdac0a7dac6081756713abfb8bb571f0c2

Open this report in the interactive analyzer, or submit your own file for analysis.