Malicious PDF — malware analysis report

Static analysis result for SHA-256 953038c48b2f04c7…

MALICIOUS

PDF

74.4 KB Created: 2021-06-07 00:18:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5419d009c5594c8a5696c7339403138d SHA-1: e61b0b44488013f66d584321dc7e28f12953fdad SHA-256: 953038c48b2f04c7ad0444ad8c5a58938c65aa0cd61b93cf80c475f73488bb73
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text referencing a "Pixel gun 3d hack download android no survey", suggesting a phishing or scam lure. The embedded URL points to a domain associated with such lures, likely serving as a download link for a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9740

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=pixel+gun+3d+hack+download+android+no+survey
    • https://static.s123-cdn-static-d.com/uploads/4450044/normal_60b004eaab291.pdf
    • https://cdn-cms.f-static.net/uploads/4415782/normal_60141ed28ef6b.pdf
    • https://cdn-cms.f-static.net/uploads/4474191/normal_6022f6716dfbc.pdf
    • https://static.s123-cdn-static.com/uploads/4482623/normal_6001d43be41e2.pdf
    • https://static.s123-cdn-static.com/uploads/4412900/normal_5ffa2da3b180a.pdf
    • https://cdn-cms.f-static.net/uploads/4403262/normal_6041903d553c9.pdf
    • https://static.s123-cdn-static.com/uploads/4457849/normal_5fcd7c070b8df.pdf
    • https://tirepululavapiw.weebly.com/uploads/1/3/4/5/134576363/646c722.pdf
    • https://morizuni.weebly.com/uploads/1/3/4/6/134606759/sesomenesimediv.pdf
    • https://cdn-cms.f-static.net/uploads/4484097/normal_6030fc7e1d38d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nelivameg.pbworks.com/f/walor.pdf
    • http://sikovifif.pbworks.com/w/file/fetch/144472500/domestic_violence_month_may.pdf
    • https://uploads.strikinglycdn.com/files/67db2807-be46-4b4b-a1ab-26cde7c2a8ed/kyocera_printer_customer_care_number.pdf
    • http://xedidovetaw.pbworks.com/f/son_of_bigfoot_trailer_2018.pdf
    • http://bowawesup.pbworks.com/f/guburamobovegakulowarujam.pdf
    • http://nipekari.pbworks.com/f/how_do_you_fix_no_sound_on_iphone_7.pdf
    • http://sagidetubi.pbworks.com/f/18228791534.pdf
    • https://uploads.strikinglycdn.com/files/7a72e5c3-31c3-4b0d-b828-e57af24e8776/54086796731.pdf
    • http://jobagej.pbworks.com/w/file/fetch/144751158/39419181433.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de1f.bin
6a6c42e8eb4b2f8d77c58985dca28949b079d228eab3deded42303949450289d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE1F 3856 bytes
font_01_sfnt_off0000ebdc.bin
9ebe83d1730d34bdf9c1b1d7378f4cd5f0328fb8049c57a5f1b3c63bfad897c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBDC 5556 bytes
font_02_sfnt_off0000feb8.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEB8 1800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.