Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd2a1f5c25d9201b…

MALICIOUS

PDF

85.6 KB Created: 2020-11-10 14:07:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f364025065c209ff619ef738cdbd0a59 SHA-1: 150dc3a98198b5812ac6dc396266a940a02f10df SHA-256: dd2a1f5c25d9201b73930d2269707aa9e86d989c9f6508d7ae37a76a2aa526d0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URL that leads to a suspicious domain, likely intended to trick the user into visiting it. The document body, though heavily obfuscated, contains keywords related to games and apocalypse, aligning with the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?keyword=unblocked+games+for+school+zombie+apocalypse
    • https://cdn-cms.f-static.net/uploads/4420930/normal_5f9630b9eb76f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/932dac27-721b-4c27-ab7d-cce8da05854b/3103225712.pdf
    • https://uploads.strikinglycdn.com/files/d1594944-81d0-4e75-a494-b338cadde840/61506145335.pdf
    • https://uploads.strikinglycdn.com/files/eca84ca8-6685-4146-b486-db43fcc022d0/examples_of_logos_ethos_pathos_in_advertising.pdf
    • https://s3.amazonaws.com/fasanag/95124920684.pdf
    • https://s3.amazonaws.com/falevi/bobivikolerigalal.pdf
    • https://uploads.strikinglycdn.com/files/efdac109-4724-49d8-bc94-eabb6028af7f/descargar_peliculas_dvd_full_iso.pdf
    • https://uploads.strikinglycdn.com/files/e08117c2-8d27-4d56-84ad-16fa2bffcaaf/71224037020.pdf
    • https://uploads.strikinglycdn.com/files/1c93a53a-48e1-4205-b378-f1ee10cb2ff4/26110392038.pdf
    • https://uploads.strikinglycdn.com/files/290b0771-4828-4b55-baf5-4877f1af6957/tribunal_de_la_acordada.pdf
    • https://s3.amazonaws.com/mudurixo/polarization_of_light_by_double_refraction.pdf
    • https://s3.amazonaws.com/pazovugal/hisense_tv_manual_50h5gb.pdf
    • https://uploads.strikinglycdn.com/files/53348487-d42f-4558-a335-c0725803cf1d/widotuposelud.pdf
    • https://uploads.strikinglycdn.com/files/05efa222-6bbd-47ef-82f8-93f1c58e32fe/36039429589.pdf
    • https://uploads.strikinglycdn.com/files/b6c1913f-e2f7-4020-9dd3-2e2e5c4d9e15/texas_driving_manual_2019.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00011bbd.bin
8f0ff1881c42c7f63c3b69f5d62193f35b541ee3538705e873b4766b426f85a4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11BBD 19124 bytes
font_00_sfnt_off0000def7.bin
14fdcb3af2b0359a3f7d6ff620a18bc665f5c973e73b6a69f8c2f84878c43bfe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEF7 5624 bytes
font_01_sfnt_off0000f1e2.bin
84015e56ec39a9b567d62511afc65636de74ca8f74af865b10da7e915d430a9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1E2 12956 bytes
font_03_sfnt_off00013a3c.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A3C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.