Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b12d7ab692ec549…

MALICIOUS

PDF

81.2 KB Created: 2021-03-16 00:14:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a9cb02fa621cf46263790840a5fd564 SHA-1: 27316c9a534df2fdcc0e743cafa00bc1263d34b9 SHA-256: 9b12d7ab692ec549fd3e6e050dd0090b59ffecb07c69c8501d4d16a048acfeb2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a site offering a game mod, which is likely a lure to entice users to download further malicious content. The PDF structure itself also contains suspicious elements related to duplicate object bodies.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=kingdom+rush+vengeance+mod+apk+1.6.3
    • https://static.s123-cdn-static.com/uploads/4405194/normal_6008ee09d421a.pdf
    • https://cdn-cms.f-static.net/uploads/4406228/normal_603748d4e3b6a.pdf
    • http://dakekunagefasak.sportsontheweb.net/41824786729.pdf
    • https://cdn-cms.f-static.net/uploads/4388598/normal_5fe9da5cc4b0d.pdf
    • https://cdn-cms.f-static.net/uploads/4367013/normal_604fd9cbe9929.pdf
    • https://cdn-cms.f-static.net/uploads/4369631/normal_604e15b551826.pdf
    • https://cdn-cms.f-static.net/uploads/4444850/normal_6043782c3171c.pdf
    • https://cdn-cms.f-static.net/uploads/4411919/normal_603d304a5b08b.pdf
    • https://cdn-cms.f-static.net/uploads/4392869/normal_60188753a0d1b.pdf
    • http://gagilirefoj.22web.org/hdfc_mutual_fund_kyc_form.pdf
    • https://cdn-cms.f-static.net/uploads/4448332/normal_602dd48ea8d7a.pdf
    • http://gejulavofanutar.mygamesonline.org/11415067737.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3bf2275c-4ce6-4f5f-bf9f-cb6833bc303e/95093284936.pdf
    • https://uploads.strikinglycdn.com/files/65d83947-f3cc-4931-bba7-e80fc1a44166/ejercicios_resueltos_de_identidades_trigonometricas.pdf
    • http://xijobepiza.epizy.com/macbeth_character_key_quotes.pdf
    • http://xuxerutiwuv.onlinewebshop.net/95674995723.pdf
    • http://vawerudarasikow.myartsonline.com/what_causes_eczema_on_fingers.pdf
    • http://kovobopejuwego.rf.gd/ti-89_titanium_wont_turn_off.pdf
    • http://gumizaxewa.atwebpages.com/ralph_waldo_emerson_self_reliance_analysis.pdf
    • https://uploads.strikinglycdn.com/files/2b384407-2f66-4a88-9607-0c50286dd81c/xuvokasikuzuwixirovesuzav.pdf
    • http://muzudamufuvase.rf.gd/52992424215.pdf
    • https://uploads.strikinglycdn.com/files/2f89af49-6150-46c0-adad-0da6f65cf8ce/21799829607.pdf
    • https://uploads.strikinglycdn.com/files/4285b363-4c95-4d54-afca-8cd0fcc7102a/verizon_fios_24_hour_tech_support_phone_number.pdf
    • https://uploads.strikinglycdn.com/files/25c8004b-a04a-4afe-9e80-83a66650884c/cialdini_influence_science_and_practice_summary.pdf
    • https://uploads.strikinglycdn.com/files/9dddb330-1090-4adc-857b-c7d867559f85/how_to_write_a_descriptive_essay_for_grade_4.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe0e.bin
ec2c6043950ed35108cc1518690f1784ba8d67565c2c50bda4062f8caf969e76		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE0E 5948 bytes
font_01_sfnt_off00011240.bin
d2693b9b83fa9af01deae6794e92da0babd014999e4a1c27b722435eaffbe573		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11240 10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.