Malicious PDF — malware analysis report

Static analysis result for SHA-256 d73c3b735127d714…

MALICIOUS

PDF

75.4 KB Created: 2021-03-05 09:05:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca07ecbe7916c56c2e7777bbfd33c931 SHA-1: 980ebf6695ae023bde0dc19b12d53c22c925191b SHA-256: d73c3b735127d7146b4134549fc29ea1a87e189432973f4b4f80056ada3444da
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains an embedded URL that, when visited, likely leads to a phishing or malware download page, disguised as a game guide. No scripts were extracted, but the presence of external URIs suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=saints+row+2+achievement+guide
    • http://jojidasusesot.sportsontheweb.net/jabugunefemosut.pdf
    • https://cdn.sqhk.co/tamejenonisi/Rjhgcjd/livamur.pdf
    • https://cdn.sqhk.co/xusarukave/idngXih/tokukawe.pdf
    • http://pakupuxojopef.getenjoyment.net/60579465124.pdf
    • http://rasazajafatirek.mypressonline.com/83372446149.pdf
    • https://cdn.sqhk.co/wibononuve/dCw8Pgc/97404196424.pdf
    • http://delinapod.mypressonline.com/95065369068.pdf
    • http://davupopebuwiser.sportsontheweb.net/sex_drugs_and_cocoa_puffs_by_chuck_klosterman.pdf
    • https://cdn.sqhk.co/lobinazema/oYmRjgJ/waxunezuluma.pdf
    • http://memowelubi.mygamesonline.org/95643566088.pdf
    • https://biligimanud.weebly.com/uploads/1/3/1/4/131454089/b1d905f7.pdf
    • https://cdn.sqhk.co/malofavu/5AtJq8R/list_maker_online.pdf
    • https://xikewewojan.weebly.com/uploads/1/3/4/0/134095915/693abc423839df.pdf
    • http://bidizujimon.getenjoyment.net/la_fuerza_de_sheccid_resumen.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://61069a5e-3c5f-4884-a3c7-8c7552058b74.filesusr.com/ugd/0789d5_8d42682765794a1099bf2220da08b00d.pdf?index=true
    • https://s3.amazonaws.com/tanikanaw/zipulabufazo.pdf
    • https://s3.amazonaws.com/xufoxorog/lujopomubifibuli.pdf
    • https://367e539a-c541-4439-991c-4bf2bef2aa7a.filesusr.com/ugd/77d535_cc9888b36c3f461c85c151b4316816a3.pdf?index=true
    • https://s3.amazonaws.com/davolazupivowi/duziravogig.pdf
    • http://wovibojo.onlinewebshop.net/55961561125.pdf
    • https://2c549fd3-bbcc-4e43-aea5-84609313cfd4.filesusr.com/ugd/c162b3_2408d0294d8544ceab31b7624a90af0e.pdf?index=true
    • http://luvabokinoleg.onlinewebshop.net/where_is_the_shear_pin_on_a_snowblower.pdf
    • https://4f65501f-cdae-4966-b9db-49b15ad9d196.filesusr.com/ugd/52b593_35d2ab201eea48399586bf861a42fb82.pdf?index=true
    • https://s3.amazonaws.com/tedowafomaru/introduction_to_programming_using_python_exercise_solutions.pdf
    • https://de7eff9d-5c50-4122-bb99-ee112abf7a8f.filesusr.com/ugd/db8f21_248bdbbe941d4d8e91a946a9abfd3479.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8b5.bin
2c9987ec73d1cbfae8f9aa7e783319047aa694d94d4ae64d22696923958210c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8B5 5708 bytes
font_01_sfnt_off0000fc11.bin
e6a2452d2749f98977e1a2ca56f38ed4c0fb3eccb7b9352bb5a04bb034cd03bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC11 10448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.