Malicious PDF — malware analysis report

Static analysis result for SHA-256 a81d2451b1bb2855…

MALICIOUS

PDF

89.3 KB Created: 2021-03-21 02:40:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ea65c6b04ee54710a50f2dfce0f9925d SHA-1: 15068325581235659ce84ac9c1c6179e3d986e0d SHA-256: a81d2451b1bb285529bba80d381659392ead0e26856e90762511bfdfddf4de2a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is classified as malicious by ML and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains references to "Pokemon go hack mod apk 2020", suggesting a phishing lure for a fake application. The presence of multiple embedded URLs, including the primary one at `https://pelibifir.ru/wix?keyword=pokemon+go+hack+mod+apk+2020`, strongly suggests that the document is designed to redirect users to malicious sites for downloading malware or engaging in phishing activities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=pokemon+go+hack+mod+apk+2020
    • https://wadaletabuj.weebly.com/uploads/1/3/2/6/132695896/tabutevojumi-gaviwemikis-dibir-dupigubixum.pdf
    • http://setifol.66ghz.com/how_to_share_someone_elses_video_story_on_facebook.pdf
    • https://cdn.sqhk.co/bapisolel/hhfjiif/tor_browser_mac_download_unblocked.pdf
    • https://wetenonuvodipu.weebly.com/uploads/1/3/5/3/135321676/nobiruvowowij.pdf
    • http://guworumitikizu.iblogger.org/38260000513.pdf
    • https://static.s123-cdn-static.com/uploads/4448976/normal_6005bcd4b64a4.pdf
    • https://cdn.sqhk.co/nobukomorur/WNcnWhg/stickman_fight_3_mod_apk_level_52_max.pdf
    • https://cdn-cms.f-static.net/uploads/4447912/normal_600fe74ee2d4c.pdf
    • https://static.s123-cdn-static.com/uploads/4449603/normal_5fe0206a91a30.pdf
    • https://cdn.sqhk.co/sevigexew/FLwDyhh/siroguninozen.pdf
    • http://lady-bug.club/japuvadijegufaxirc4il.pdf
    • http://in-arenas.com/796547645573y9aa.pdf
    • https://rilumawireg.weebly.com/uploads/1/3/5/9/135981263/5438084.pdf
    • http://bionatur.space/rasowuf7ezaz.pdf
    • http://senukekufop.iblogger.org/how_to_set_time_on_armitron_digital_watch_wr330ft.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://takamuwemevofe.epizy.com/nejoduwaposejudakarefuxo.pdf
    • https://s3.amazonaws.com/fuvidokibet/adaptive_cruise_control_seminar_report.pdf
    • https://s3.amazonaws.com/pugomonapoxuxe/cirrose_alcolica.pdf
    • http://sisakuwoxamale.rf.gd/mixugapuli.pdf
    • https://s3.amazonaws.com/sorapobuk/refuse_booting_software.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef7c.bin
24fd6868f187b5667792517f9f69d22ac5a3de5011d4d3824467392effeade79		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF7C 6588 bytes
font_01_sfnt_off0000fff6.bin
56315774d8f3b792ca12f4eaa523cde4f8125f4b8d77429f54546268fef6d953		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFF6 5520 bytes
font_02_sfnt_off0001129a.bin
a98bccc0198958cc9e1dbd98b0fc3a5b675acc3cc1276b3c1dfa9dd75f0b5912		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1129A 2052 bytes
font_03_sfnt_off00011c4b.bin
955c6bdd77f904c5b14526f943fe4a43c7aba62d1ed94f5108a689f32a5f3f73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C4B 11212 bytes
font_04_sfnt_off0001423e.bin
076775b5863c6e027fc788b5b8985d17f1c4669d0001ae0ea71f74f9425ebf78		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1423E 16064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.