Malicious PDF — malware analysis report

Static analysis result for SHA-256 902d83b6d3b8a2d8…

MALICIOUS

PDF

78.1 KB Created: 2021-04-22 11:44:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8f99b1efea37ce60bb4f339ae737328a SHA-1: b793c099f200d4ae443bacc4df03c52104f5d0df SHA-256: 902d83b6d3b8a2d8b3292f8667f787e43b97d8e01fb0abf6915d16d2b9d0f471
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a search result for a popular game, likely to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, and the presence of embedded URLs points to a phishing or credential harvesting attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URI heuristic suggest it's designed to redirect users to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=is+pyramid+head+in+silent+hill+1
    • http://reduslim-italiaofficial.site/ramavewibimixikanolukigic0m9f.pdf
    • http://juponuziwotaga.mywebcommunity.org/all_candlestick_chart_patterns.pdf
    • http://creditscorecard.info/wolovewaxubepelattj8rd.pdf
    • http://rezltml.xyz/936378384344fagk.pdf
    • http://edaeda.moscow/40k_9th_edition_ruleszckdp.pdf
    • http://xamoxipuwizutux.scienceontheweb.net/rupukopapofebofoximorute.pdf
    • http://olimp-home.com/vudexowatibezexasewosipuxtyx6o.pdf
    • http://mobeditobaxul.scienceontheweb.net/nilususajodevikafur.pdf
    • http://sepozimog.scienceontheweb.net/konukufomitunirinu.pdf
    • https://cdn-cms.f-static.net/uploads/4382973/normal_6058fae00f85a.pdf
    • http://goxamid.mypressonline.com/cognitive_behavioral_therapy_for_depression.pdf
    • http://afracheat9.xyz/senowiwudirae3vbm.pdf
    • https://cdn-cms.f-static.net/uploads/4460477/normal_603e655180f16.pdf
    • http://nuverlites.online/42392784391a627z.pdf
    • http://tenipimutav.mywebcommunity.org/robert_anton_wilson_prometheus_rising_audiobook.pdf
    • http://insurancecarusa.com/how_to_watch_peaceful_warriorbiiw3.pdf
    • http://retys.fun/stihl_trimmer_gas_type0x92k.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://novupomajanox.atwebpages.com/bixibibemetumunu.pdf
    • http://segurixuzek.myartsonline.com/xegojido.pdf
    • https://uploads.strikinglycdn.com/files/a1dc112c-7025-49a3-95f9-4956100e9643/82894917371.pdf
    • https://uploads.strikinglycdn.com/files/6eb7df5b-68d5-452c-9f1d-6ba8e6e24a7f/13718830962.pdf
    • https://uploads.strikinglycdn.com/files/2a2ab2d4-28d9-4367-bb40-fa4f52f5686a/34645309949.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f283.bin
f52340b6bbb53b359651f2e430a6152199a2862fc60a201ed31a9b405d6e7ee9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF283 5292 bytes
font_01_sfnt_off00010454.bin
a072e429f5029331ec7d430e8c07937e27e4ad84fad736d7fe841a97bd45940e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10454 11372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.