Malicious PDF — malware analysis report

Static analysis result for SHA-256 db5263d88c916ba9…

MALICIOUS

PDF

76.2 KB Created: 2021-03-19 20:14:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 60e985992ee637cff6984f8e68fe95d8 SHA-1: 44d75b0b43e7264b96e92c1bb0ad2bbc3d4f4f94 SHA-256: db5263d88c916ba99d8c0b33999d6ce4e6f214ffe942a3dfe3e92912864cb6b6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL 'https://vilenefex.ru/wix?keyword=download+apk+root' strongly suggests a phishing or malware distribution attempt, likely related to downloading Android applications. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs point towards a social engineering tactic to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=download+apk+root
    • http://vodoroding.info/sinasmr0cf.pdf
    • http://goodshopsales.xyz/dagupamapepajafupeobg0a.pdf
    • http://sawemawe.mywebcommunity.org/annabelle_hayes_workout_program.pdf
    • http://jonebukusopovet.mygamesonline.org/what_does_patriotism_meaning.pdf
    • http://lezirumari.sportsontheweb.net/entresto_package_insert.pdf
    • http://simultaneously.space/pivibobodukugiyw7fh.pdf
    • http://lngcliente.com/27886704218t7ppb.pdf
    • http://crysety.xyz/short_story_lengthst2ay.pdf
    • http://baxemoge.iblogger.org/jobidunemisigo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c245485c-e1a4-4c5a-9a2a-c465a95e53c8.filesusr.com/ugd/25f824_8de99e1281994c988c091ca56453049b.pdf?index=true
    • https://507f79ed-2408-4027-b124-45ed49bded7d.filesusr.com/ugd/2de61b_8e4bf7e489614bec808a818374218aa3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e498d28f-2a7e-48b5-a379-7b9a93411493/nashville_number_system_chart_for_guitar.pdf
    • https://uploads.strikinglycdn.com/files/76a40800-315b-4ab0-a59f-ca5b82567fa1/how_to_identify_organic_functional_groups.pdf
    • http://kunerev.epizy.com/barbie_doll_pic_hd.pdf
    • https://ad0d0dbb-669b-46a9-85df-79487014a0f3.filesusr.com/ugd/00d95d_4f66f94e817c4ba7986193fc92cb222c.pdf?index=true
    • https://044ec7df-721b-4788-b209-87474a3fcb06.filesusr.com/ugd/60ffa2_54aa71b46c034f85a73de6fac64b3f1e.pdf?index=true
    • http://naxaxibo.rf.gd/76352478619.pdf
    • https://uploads.strikinglycdn.com/files/e66791bc-eeac-4d31-9027-7fa554f8a4cf/pobazajuwevax.pdf
    • https://uploads.strikinglycdn.com/files/25058bbd-5054-4d66-acda-38db80647f43/britax_marathon_car_seat_expiry.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee46.bin
322c9b7205ae5992f833a0e9d183c9f9a7a031f76c2a835e81f5f3f62f6cc239		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE46 4928 bytes
font_01_sfnt_off0000ff34.bin
eb3903febb04cf2f5babe48f38e64ae614f941877127371a342c2e415125aa4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF34 10864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.