Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3dbd5ab1b83dfcf…

MALICIOUS

PDF

92.1 KB Created: 2021-03-23 23:27:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e2f097979efcaf413fde94ecd2904b4c SHA-1: 4fc6920bad2c64ff59fb077ee3468cac06b877e5 SHA-256: c3dbd5ab1b83dfcf3b5b2cfc7da63f2daa11a8952a1a646bdf588ac2e1e46e4e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a URL that is disguised as a download for 'simcity deluxe edition apk'. This URL is likely used to deliver a malicious payload. The ML classifier and ClamAV detection strongly indicate malicious intent. The PDF structure and embedded URL suggest a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=simcity+deluxe+edition+apk
    • http://thelandofbadideas.com/53747794319jynb2.pdf
    • http://kpovli.ru/craftsman_60_volt_chainsaw_reviewdx3l4.pdf
    • http://znalomstvavip.site/98597452822969jd.pdf
    • http://mp4.design/fanunagugam5neie.pdf
    • http://powuvomewekuxeb.getenjoyment.net/is_it_safe_to_make_steak_tartare_at_home.pdf
    • https://cdn.sqhk.co/nexasolonit/hjeiaZJ/55634570852.pdf
    • http://stakingyfi.com/fleck_5600sxt_water_softener_price4eurn.pdf
    • http://topcabinets.xyz/dipirdlzps.pdf
    • https://cdn.sqhk.co/wujozuzewed/hb6Y8Gn/gevev.pdf
    • http://zanartcc.net/kamiwozupikaginxaka.pdf
    • http://freefire-gifts.com/free_invoice_template_for_services_providedm7yzw.pdf
    • https://cdn.sqhk.co/zafilivopupu/crjhB1W/boss_2_dj_song.pdf
    • http://kindraretterath.com/catch_fire_jenix_songo4sft.pdf
    • https://cdn.sqhk.co/pulazapusaw/HCgdmic/sisoxedosapikopokol.pdf
    • http://vashe-zdorovie.xyz/college_algebra_clep_practice_testgv3gb.pdf
    • http://kixurox.getenjoyment.net/bivariate_poisson_distribution.pdf
    • http://gumidaz.medianewsonline.com/hp_laserjet_p3015_toner_cartridge_replacement.pdf
    • https://cdn.sqhk.co/buvaboda/gieghja/72335765305.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/31d8ddff-775e-45b0-bdcd-0a8abb831c8d/79619694588.pdf
    • https://uploads.strikinglycdn.com/files/18c50e98-a8d5-494b-a57b-b94c69d68a56/percy_jackson_the_last_olympian_audiobook_chapter_1.pdf
    • https://uploads.strikinglycdn.com/files/50879cce-53dc-41e9-b901-91843a7d2919/best_quote_of_forgiveness.pdf
    • https://uploads.strikinglycdn.com/files/be5cbc71-2d2b-4f4b-89b5-8e160da1fdfb/the_selection_series_books_online.pdf
    • https://uploads.strikinglycdn.com/files/de8caaa7-0576-4ff4-8774-cd6d4bfa2431/whirlpool_cabrio_dryer_wont_start_just_beeps.pdf
    • https://uploads.strikinglycdn.com/files/8046b8c1-659e-4b31-aafb-9354b79ff4b5/sezezem.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000127cb.bin
14d5eec868e92ab151e80a6bdd4e31cda4fa2c2c1f19fe9c8cfa8aa20a6fb3bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127CB 5280 bytes
font_01_sfnt_off000139c5.bin
75080df75af4ad4e854ddd17ba7271ef37cf38253b086cf3550e5c4423a3cf6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x139C5 12420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.