Malicious PDF — malware analysis report

Static analysis result for SHA-256 b39b674beb9fd234…

MALICIOUS

PDF

78.9 KB Created: 2021-03-15 10:53:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8edbb30afd443fb60a21c21960927d4b SHA-1: 40d248cc2eefab4eae5fbb785bc9f669310924ad SHA-256: b39b674beb9fd234ac52eb8ecede1849477f6dee45f5866894e635734188fd45
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan distribution attempt. The embedded URL and document body content suggest a lure to download an 'apk' file, likely a malicious application. No scripts were extracted, but the presence of external URIs points to a download or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=choice+of+games+full+apk
    • https://static.s123-cdn-static.com/uploads/4475376/normal_5ff868a787d07.pdf
    • http://cadenalia.com/12771182130brk5f.pdf
    • http://svoylend.xyz/lightroom_mobile_presets_mod_apkvukut.pdf
    • http://xuziduliwilu.iblogger.org/who_played_the_high_sparrow_in_game_of_thrones.pdf
    • https://cdn-cms.f-static.net/uploads/4497095/normal_603eb258f0bf7.pdf
    • https://static.s123-cdn-static.com/uploads/4501364/normal_5fe04b1900e18.pdf
    • https://cdn-cms.f-static.net/uploads/4425915/normal_6046521a6405e.pdf
    • http://copyrightshelpcenter.com/15628560775t5hku.pdf
    • http://umniashka.ru/foscarnet_administration_guidelines4yewh.pdf
    • https://static.s123-cdn-static.com/uploads/4372702/normal_60011dc8f0b6e.pdf
    • https://static.s123-cdn-static.com/uploads/4427273/normal_5feb2b9d57ffc.pdf
    • https://cdn-cms.f-static.net/uploads/4470679/normal_604bac6f33e71.pdf
    • https://static.s123-cdn-static.com/uploads/4447434/normal_5ff9c5bdbd02c.pdf
    • http://fishing-rods2.club/how_many_atoms_are_in_glucose3drzc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wereguvepowu.epizy.com/second_hand_android_phones_ebay.pdf
    • http://nibejodawugizex.rf.gd/futatajojifowo.pdf
    • https://uploads.strikinglycdn.com/files/d5fc20ba-7922-4867-a4b1-654813e1f27c/t.i_justin_timberlake_dead_and_gone_lyrics.pdf
    • https://6cf80756-66c2-4d2e-b15d-ff1677cb7115.filesusr.com/ugd/2257e8_231a5b245de545e5b0b5072617f48116.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2ce079bb-5afc-4221-bbe6-dd2251dc4714/tabedesudoguw.pdf
    • http://zezajezo.epizy.com/50321223182.pdf
    • https://d0bf7e8b-5449-41c0-93e9-161603c0719f.filesusr.com/ugd/197ed4_52aac828aba64604b329c565640af4e5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a0cdb9d9-62be-4811-9346-186671caaef7/firex_smoke_detector_chirps_twice.pdf
    • https://uploads.strikinglycdn.com/files/ac39dfeb-fb44-4a26-8c3b-4e7200b4c6e1/gabetijaben.pdf
    • http://tikigare.rf.gd/how_to_become_a_successful_youtuber.pdf
    • https://uploads.strikinglycdn.com/files/ee56ac98-dcef-4d04-8ba3-5da6f89667b7/sowura.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f122.bin
e5becb167c3cd3578957ff170ad5460080b278218d8ff575a6a3c592c43154af		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF122 5300 bytes
font_01_sfnt_off00010310.bin
743c114a16b44401ad4e273b7face0a86f2219d37c1d5660cc92e9c15d584203		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10310 12800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.