Malicious PDF — malware analysis report

Static analysis result for SHA-256 be18b968bc8b8858…

MALICIOUS

PDF

92.4 KB Created: 2021-04-07 08:13:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d2004cd3cff7946507407f2e1740ff2a SHA-1: 5569fc578d85e6201bf517b2615ff304354bc9e3 SHA-256: be18b968bc8b8858f68cc48ea6cf5e1b444f7921b42b470218cd820ac46cb1db
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'vilenefex.ru', which is likely used to host a phishing page or download further malicious content. The document body, though heavily obfuscated, contains keywords related to 'Mafia city' and 'guide', suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=mafia+city+guide+reddit
    • http://kavakedego.scienceontheweb.net/the_best_of_me_dawson.pdf
    • https://cdn.sqhk.co/valujoper/mRggIhj/jodim.pdf
    • http://trells.space/acet_exam_papergb47t.pdf
    • http://kdghy.online/dead_ahead_zombie_warfare_apk_modve9bk.pdf
    • http://figedizizexi.22web.org/wakekemewumata.pdf
    • https://cdn.sqhk.co/bedazume/wgcNhaj/zebedulanofebomir.pdf
    • http://bukuminuwakub.mypressonline.com/fuzof.pdf
    • https://cdn.sqhk.co/libewepigux/yhghejf/77882476644.pdf
    • http://movikewenatorug.iblogger.org/aggressive_periodontitis_case_report.pdf
    • http://mobutadaxez.medianewsonline.com/dizalesitikuwetirojexataj.pdf
    • https://cdn.sqhk.co/tumowara/cLidpid/7_minute_workout.pdf
    • https://cdn.sqhk.co/duravukikemo/yjhdC46/gefebalinegifubig.pdf
    • http://dosaxixapaxa.medianewsonline.com/85775553491.pdf
    • http://tupaxeguna.scienceontheweb.net/meaning_nature_and_scope_of_public_personnel_administration.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://78151a86-a557-4e49-81aa-a2539eea45c7.filesusr.com/ugd/204f4f_ee1a19914a2a4bb5813611d0ab0d8f0e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/16edc7b4-aa4b-42f0-918c-e8767557db99/17349077778.pdf
    • http://tizovosavudufi.rf.gd/22182497821.pdf
    • https://65d0a56f-4074-4e8f-9acc-29e6f8e8f663.filesusr.com/ugd/37655d_13f0c034328540fbbbf18e4860d6598c.pdf?index=true
    • https://fae5df41-d68b-4d62-9961-cd33801cec7e.filesusr.com/ugd/f52c73_7b74999a066741c9b9f4df17db69ab4c.pdf?index=true
    • http://fumitosavewi.rf.gd/wuwuzate.pdf
    • https://uploads.strikinglycdn.com/files/aa926d3c-d1da-4956-8700-346dc1ec476d/laxawowibuvakej.pdf
    • https://uploads.strikinglycdn.com/files/0c0005e9-0c7b-4905-9cf2-8882c14c3c56/cuanto_milimetros_tiene_una_pulgada.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001164a.bin
48e0c8232a3c45bca481059132e7425de0b9875c136390f7f7e233ccd9ab1f28		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1164A 5084 bytes
font_01_sfnt_off000127bc.bin
feea01444c5d3ff0cd270874bec3988b8923568c203114c6b58e9677aadc8b6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127BC 11176 bytes
font_02_sfnt_off00014e43.bin
678e846888c43b15e35873d1f4753444e776fe8e183c12946796880ead959e16		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14E43 16156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.