Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae71c6403c2967bf…

MALICIOUS

PDF

76.5 KB Created: 2021-03-31 21:59:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cec297e0125f91b5ccc849b201ce50c8 SHA-1: 6beebd7c2aec47a242f194567918589772143f2e SHA-256: ae71c6403c2967bf68fd8910d8f12741df44caf82fb857d5c95ffe17fa2b511f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan. It contains an embedded URI pointing to a URL that appears to be a lure for downloading a game, suggesting a phishing or social engineering attack. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the presence of external URIs and the phishing classification point to a malicious intent to trick users into downloading further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=total+conquest+offline+apk
    • http://itawegan.fun/prefix_and_suffix_worksheets_with_answers_doc1n2e7.pdf
    • http://4338bacchus.com/trigonometry_formula_free_download6serv.pdf
    • https://zupelewelasilag.weebly.com/uploads/1/3/4/5/134594614/jalepifiliv.pdf
    • http://xuxijosut.sportsontheweb.net/apartheid_laws_from_1948_to_1994.pdf
    • http://vekisonoloze.sportsontheweb.net/poxaxu.pdf
    • https://powufekati.weebly.com/uploads/1/3/4/0/134012492/natubuvodidonenuwobi.pdf
    • https://ribuborufexegax.weebly.com/uploads/1/3/4/5/134507127/rokamazekeziwiz.pdf
    • https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/8204272.pdf
    • http://ryukzak.digital/26663202332jiosc.pdf
    • https://metidesu.weebly.com/uploads/1/3/4/4/134492072/9701060.pdf
    • http://bahis-sikayet.com/vazixakikopesefojaw4zjaf.pdf
    • http://beviluxenumiliv.mywebcommunity.org/wd_my_passport_wireless_pro_4tb_review.pdf
    • http://lnstagramlivesupportcenter.com/zoramowadaxulamiwaseksvkx.pdf
    • http://shopsupergood.site/wezerejapibqspu.pdf
    • http://braco.ru/85194396259liux8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/63a644c7-17b1-474b-80e5-9656b915b1c9/95527383114.pdf
    • http://xogijowag.onlinewebshop.net/52638788414.pdf
    • https://uploads.strikinglycdn.com/files/4eae0cc2-342b-4484-b593-87e977af70f6/15215902823.pdf
    • https://b32521b7-32ca-447e-9967-d27d0dce683d.filesusr.com/ugd/800b88_97fce0163e9b42a0976cf7cfdfdfc0b8.pdf?index=true
    • https://a4edf7fa-b057-49b5-8014-e5fd436fbef3.filesusr.com/ugd/c8b2c5_bbd40a8f769343bb9c2fed0bdb357530.pdf?index=true
    • https://ff0b3df2-dc61-4aeb-9024-93fa9b5bc175.filesusr.com/ugd/aa14a9_59f9dde95cb248dcb46260d231fef83d.pdf?index=true
    • https://9f349447-249b-4747-956a-316fe86e371b.filesusr.com/ugd/d2b720_0ea51fc9f4e942378b1ca93d20ae3c2c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d92bd71f-5d26-496e-8802-0b244cd50823/best_feats_for_druid_pathfinder.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eadf.bin
76063b6fa4e63e7574022dd15d45d73ebe9ff9166c83fc39f212edd4769fbd5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEADF 5052 bytes
font_01_sfnt_off0000fc32.bin
21dafdc6d1ebf8b156c1f81bf4482de5cf47ed8fdb9fbc8827ba1c7d0eed0375		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC32 12524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.