Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8cfb0453173dbab…

MALICIOUS

PDF

79.9 KB Created: 2021-03-09 09:00:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a4aa31cc2b0e09ca27f401e49388c96 SHA-1: e262e4c4ce41a53e19c995a756f29e5cbd6b80ce SHA-256: d8cfb0453173dbabb285a378e237381f1d82558f33311465a5db8095f6a0c59e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and heuristics indicate it is malicious, specifically flagged as a phishing trojan by ClamAV. The document body, though partially corrupted, suggests a lure for downloading 'Nba 2k15 apk data offline'. The presence of external URIs points towards a phishing or malware distribution attempt, likely using a spearphishing attachment vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=nba+2k15+apk+%252B+data+offline+free+download
    • https://static.s123-cdn-static.com/uploads/4388279/normal_5fc99588a9511.pdf
    • https://static.s123-cdn-static.com/uploads/4461773/normal_5fe23c3dd9e81.pdf
    • http://raderojazoz.iblogger.org/wupuwebus.pdf
    • http://supermagazforsale1.xyz/dell_latitude_e6510_chargery59ml.pdf
    • https://static.s123-cdn-static.com/uploads/4413454/normal_5ff2d6fa21837.pdf
    • https://static.s123-cdn-static.com/uploads/4375087/normal_5feb210f32bf6.pdf
    • https://cdn-cms.f-static.net/uploads/4421473/normal_603aee9ada36e.pdf
    • https://cdn-cms.f-static.net/uploads/4387229/normal_60346033df5ea.pdf
    • http://ompala.store/interior_design_institute_melbournejnkck.pdf
    • http://domastmsk.space/references_citation_format73rjn.pdf
    • https://static.s123-cdn-static.com/uploads/4458417/normal_5fcaf6701e042.pdf
    • http://passive-income.ru/83332536906vgt34.pdf
    • https://cdn-cms.f-static.net/uploads/4451376/normal_600d2798c3f01.pdf
    • http://nubolutlion.xyz/high_yield_biostatistics9l6jp.pdf
    • https://static.s123-cdn-static.com/uploads/4389084/normal_600767ed4e1b3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8f88aa67-c757-4466-9bc9-4399daa309ff/98354450737.pdf
    • http://folilef.rf.gd/free_printable_sheet_music_god_bless_america.pdf
    • https://uploads.strikinglycdn.com/files/1d3ba594-c802-4cdc-b61f-a172eb541c10/20274338632.pdf
    • https://uploads.strikinglycdn.com/files/e1f4421b-35f6-4304-9695-def608fc89f0/como_consertar_um_fone_de_ouvido_da_apple.pdf
    • https://uploads.strikinglycdn.com/files/766beae2-3034-4c41-bfa7-409124cc6998/how_to_make_a_print_of_a_painting_on_canvas.pdf
    • https://uploads.strikinglycdn.com/files/160aeacf-6944-4ff4-9b9c-f0a8f185eef1/unreal_engine_4_tutorials_c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f900.bin
42b682f0a192ba074fc5121ac951ea3c6c5f6007f3cfcc673519c7eeea1a2487		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF900 5432 bytes
font_01_sfnt_off00010bae.bin
5448c2d226d883dca309d59d33f971ba3fcd745dca0acbdbc8c09f9fbe4cc79b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BAE 10924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.