Malicious PDF — malware analysis report

Static analysis result for SHA-256 b482ff35e1c0e0c7…

MALICIOUS

PDF

90.6 KB Created: 2021-03-26 08:29:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 27904c192099e6f9047713aa1eabcb71 SHA-1: 37cd7f5152380b6e5bb7a82627b1c5bc77adf736 SHA-256: b482ff35e1c0e0c7a2616645ad1ce370049d20df0ee71f5bc6dd9eaf006c8239
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an external URI pointing to a URL that appears to be related to 'wwe champions hack ios', suggesting a lure for game cheats. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URI are consistent with phishing or malware delivery, likely using embedded JavaScript to facilitate the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=wwe+champions+hack+ios PDF link annotation
    • https://cdn.sqhk.co/wifilivemij/icko9hY/fobeserenegakokomeloso.pdfIn PDF document text
    • http://getyourscore.info/zobetazetiwumabekuffr8fc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367674/normal_6056e946d3bc7.pdfIn PDF document text
    • https://cdn.sqhk.co/wepiwuvume/a9d23O7/traffic_run_free_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465707/normal_6056584028f3b.pdfIn PDF document text
    • http://newyearshop.site/honeywell_t4_thermostat_installation_manualiqxkl.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421224/normal_603713493c650.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454052/normal_605ca3d3ba61d.pdfIn PDF document text
    • https://cdn.sqhk.co/bifugudawesu/Zjgo3Eq/cold_war_beta_end_date_xbox.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471723/normal_6006880bf4001.pdfIn PDF document text
    • https://cdn.sqhk.co/tupipitijil/eiao2Y1/juventus_new_logo_vector.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ef38809-392d-4c2a-aa56-953a586e965d/expert_at_the_card_table_francais.pdfIn PDF document text
    • https://s3.amazonaws.com/xotomisen/appium_1._6._3_for_mac.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f06c2e9b-36f8-43cd-922c-79a3ce3eafdd/fizigiwa.pdfIn PDF document text
    • https://s3.amazonaws.com/xeruxaxer/vibinukute.pdfIn PDF document text
    • https://s3.amazonaws.com/wefadep/who_are_the_characters_in_the_story_the_last_leaf.pdfIn PDF document text
    • https://s3.amazonaws.com/babetafaperaxov/bopejo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64399fd4-efab-4ae8-be10-4ddbd02052b3/how_do_i_reset_my_orbit_sprinkler_timer.pdfIn PDF document text
    • https://s3.amazonaws.com/zepifudoxapo/22348180431.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f184.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF184 6744 bytes
SHA-256: 0eac1552a6a0cc8d6d43e14f5c157d052ff2bf21460314f67a2c213e0a454e63
font_01_sfnt_off0001026b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1026B 5216 bytes
SHA-256: acf613bae08e5239df88e3a2742ee071f11075252e59ec8740a108164a08262b
font_02_sfnt_off00011417.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11417 2108 bytes
SHA-256: 4625e796748b575568e8d7bdaf9b529ac73c3d4a97bbbd31721be51ea0c2d7e3
font_03_sfnt_off00011de6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11DE6 11652 bytes
SHA-256: 7c93d636072fcbab855c2238d4f9a5fe7d789e9f5dee2af653813bffeb7ce4d2
font_04_sfnt_off00014554.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14554 16164 bytes
SHA-256: 9026f3b3db4823843c0cd60ab9659202f9f06131997374a39278b243e9da0b8e

Open this report in the interactive analyzer, or submit your own file for analysis.