Malicious PDF — malware analysis report

Static analysis result for SHA-256 b11f13dcf278b7dc…

MALICIOUS

PDF

206.5 KB Created: 2021-02-19 05:29:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 99db9d330b2046028141d70e77161f74 SHA-1: dcd34ca9bed40cd97e0ab8e7f04dcdad1c28e260 SHA-256: b11f13dcf278b7dccc76192e4796c4d4f918918142f3398dd7792e75f07d71f7
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, suggests a lure related to 'special characters league of legends euw'. The presence of an external URI and the ClamAV detection strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3181

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=special+characters+league+of+legends+euw PDF link annotation
    • https://cdn.sqhk.co/zodunoxurob/OEjggcz/samsung_level_u_wireless_headphones.pdfIn PDF document text
    • http://stnold.com/dekemulebef1pcw0.pdfIn PDF document text
    • https://gopilabuvimira.weebly.com/uploads/1/3/1/4/131453416/jadapi.pdfIn PDF document text
    • http://ita-women.space/80552647250a6z7q.pdfIn PDF document text
    • http://small-italy.space/tuba_buyukustun_new_seriesa5u4k.pdfIn PDF document text
    • http://verexexomebot.iblogger.org/les_meilleurs_antivirus_pour_android_gratuit.pdfIn PDF document text
    • https://wakavofidokevi.weebly.com/uploads/1/3/2/6/132681750/479913.pdfIn PDF document text
    • https://xidalivukudupet.weebly.com/uploads/1/3/4/3/134319957/3035728.pdfIn PDF document text
    • http://fruitslope.online/fefaxisuxjkx4v.pdfIn PDF document text
    • https://cdn.sqhk.co/fuvebopeweb/hf5vLji/87639801085.pdfIn PDF document text
    • https://gerugufudob.weebly.com/uploads/1/3/4/8/134869234/5832329.pdfIn PDF document text
    • http://kemotunitajifap.iblogger.org/script_template_doc.pdfIn PDF document text
    • https://cdn.sqhk.co/laxepinam/hqggNgB/civil_draughtsman_define.pdfIn PDF document text
    • https://cdn.sqhk.co/dafibuxoki/f3Oic6Y/implosion_never_lose_hope_mod_apk_andropalace.pdfIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/fadedosi/debenture_interest_in_cost_sheet.pdfIn PDF document text
    • http://lafasusatar.rf.gd/jelejuxinezupozebem.pdfIn PDF document text
    • http://nimozan.epizy.com/zemilifojo.pdfIn PDF document text
    • http://waxaravibew.epizy.com/nikon_coolpix_l330_digital_camera_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/lerezazo/riweziruperuditiwezesup.pdfIn PDF document text
    • https://s3.amazonaws.com/vexeliku/ad_sports_2_tv_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off0001984a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1984A 1788 bytes
SHA-256: 6ec6f49bc2bcac8edeb029c595d487cfa5a1b0ad01e18fd84c351eb1fcc4598c
font_00_sfnt_off000114c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114C3 7016 bytes
SHA-256: a0011d65473b5908b9f76bc9ff9e6e35936b1c2382aff5c1ba025233f53f0a47
font_01_sfnt_off00012689.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12689 23224 bytes
SHA-256: 0aa9f3a89310a88e99738a0684a7357c58e7967abb08eb18569a5154248ba291
font_02_sfnt_off00015fdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15FDD 5612 bytes
SHA-256: 1668a697f84ee6809bd1eb48cd1cc4f8a289a2e5882fcfebde46cfdaee1d3e35
font_03_sfnt_off000172f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x172F8 2308 bytes
SHA-256: 009fc7367786feed523cac64045decec8377bd919696596a151e38525a3a192c
font_04_sfnt_off00017caf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17CAF 6228 bytes
SHA-256: 835dc1fb5a2d7b30022f7bc973f302afbd3e1401e349933a816a246f8983b849
font_05_sfnt_off00018bd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18BD3 3992 bytes
SHA-256: bb2f4c270fbaca60e56ce4faf20e8455f95b2ee506e676c28b6b598f7f0c86bb
font_07_sfnt_off0001a16f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A16F 2120 bytes
SHA-256: d1113c7d7e0aacd2f057df932ebcbb0712160f00539976cde04ec314f8f5675d
font_08_sfnt_off0001aa75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AA75 1688 bytes
SHA-256: 09cd6703a9b55630c0ed9215a049f5f0f099ab821b1ae03ba19a8f534a9785b3
font_09_sfnt_off0001b2e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B2E3 6068 bytes
SHA-256: eaf6e66c2bdcdfb2a4d15c07366ca0baf7938290a8ca33f3ef4c13c7984e1114
font_10_sfnt_off0001c274.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C274 32144 bytes
SHA-256: e87261c732c97b3ab0d9c851a8109aca50da4a7a50410102244820ab36b6df14
font_11_sfnt_off00021db3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21DB3 98988 bytes
SHA-256: 30a890491e3c24ab97035ebce68d2e5edad2b457434387528b9e7a13cdabf6da
font_12_sfnt_off00030b43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30B43 2572 bytes
SHA-256: 1391a2ce8e86a81dcea1ae520600e968aca936d467c2ae9fc3edb515ffe6ff09
font_13_sfnt_off00031592.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31592 6164 bytes
SHA-256: 6e61f1667810264f79d8a4448c050d64d9e8c917c08a1900993dd5c7ab4e5256

Open this report in the interactive analyzer, or submit your own file for analysis.