Malicious PDF — malware analysis report

Static analysis result for SHA-256 c29e7237fa1484d0…

MALICIOUS

PDF

84.1 KB Created: 2021-03-07 03:41:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 639731b14da85e17aee47ae88a2aebf4 SHA-1: 55cea005624c939d706d443347e2343421c49d60 SHA-256: c29e7237fa1484d07cf2b715d37bc11c939fcf31140bfd2017fc44a08bc4ae69
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that points to a malicious domain, masquerading as a search result for a popular game mod. ClamAV and ML classifiers strongly indicate maliciousness, classifying it as a phishing trojan. The presence of external URIs suggests an attempt to redirect the user to a compromised site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=dynasty+warriors+unleashed+mod+apk+offline
    • https://cdn.sqhk.co/bidekidarub/EifawNU/mekapi.pdf
    • https://cdn.sqhk.co/melipetoluf/hbfjgjh/17922952421.pdf
    • https://cdn.sqhk.co/buzunonoj/aA2kThb/56587292338.pdf
    • http://migazezi.iblogger.org/texesubunikubofev.pdf
    • https://cdn.sqhk.co/pilozarager/7pJRgfx/fishing_hook_sizes_small_to_large.pdf
    • https://cdn.sqhk.co/pomisiforuko/ejeVjdL/sugavunafatomo.pdf
    • http://form-lnstagramverifiedbadges.com/lowosatojoxugxk6.pdf
    • http://lnstagramverifycentre.com/alex_rider_operacin_stormbreaker_online_espaolybd1c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/69eb80ec-cbcd-437e-934c-08d043f8cb80/dijuzikugemawulubipakab.pdf
    • https://s3.amazonaws.com/dinisemowoge/90410608233.pdf
    • https://s3.amazonaws.com/guvovigo/audit_checklist_excel_format.pdf
    • https://s3.amazonaws.com/donukadizolin/cute_baby_images_for_whatsapp_dp.pdf
    • https://s3.amazonaws.com/baxekojojexusol/lazagap.pdf
    • https://s3.amazonaws.com/bidivo/reference_letter_for_job_template.pdf
    • http://roniwixanedif.epizy.com/zekavebus.pdf
    • https://uploads.strikinglycdn.com/files/e3ce65c1-e71f-47e6-b3d2-6884025e9e54/drunvalo_melchizedek_2020_corona.pdf
    • https://s3.amazonaws.com/gonafoziguwewe/microservices_architecture_book.pdf
    • https://s3.amazonaws.com/ronenitevodo/spontaneous_abortion.pdf
    • https://uploads.strikinglycdn.com/files/ee351d5d-68bc-465f-8911-b56376cc1a6e/pazoguvotetas.pdf
    • https://s3.amazonaws.com/jowutoneranemuk/tumukaser.pdf
    • http://wilusewi.rf.gd/do_you_add_water_to_orange_juice.pdf
    • https://s3.amazonaws.com/xipavir/rojopaw.pdf
    • https://s3.amazonaws.com/rabewiruzitewa/what_is_the_best_device_for_reading.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e273.bin
5bb50efd23811fedda54895f03e2ff3e94bcf6df6aca1560dda59dc2c6a0efc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE273 5420 bytes
font_01_sfnt_off0000f4c5.bin
b563c7606f24e038e719235d93870a971354e6cc6ba40a0ec1b29f0fda13dde8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C5 14108 bytes
font_02_sfnt_off00011cce.bin
bb58d28cf61ae6302e71e824fa33f5f436ad2167df8d8bcc8fc0108f9e74186d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CCE 16296 bytes
font_03_sfnt_off0001327e.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1327E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.