Malicious PDF — malware analysis report

Static analysis result for SHA-256 e016b5188dc2d653…

MALICIOUS

PDF

266.6 KB Created: 2021-03-16 08:05:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: f52d26bdb04f2cf335d0c8900efdab2b SHA-1: be3172c71675c603b6f0ce1b379e8a50df6e079f SHA-256: e016b5188dc2d6531ab18a61f4a2dd0e0ac44cb0b53073c0c3c1ea2b0efd66b4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to a suspicious domain, likely intended to host a malicious payload or phishing content. The document body, though heavily obfuscated, suggests a lure related to 'ipv mini 2 unlock'. No scripts were extracted, but the presence of external URIs and the overall detection profile indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9867

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=ipv+mini+2+unlock PDF link annotation
    • https://gedesinikus.weebly.com/uploads/1/3/5/3/135323437/noxuliji-gebidewi-nuvelusaxafe.pdfIn PDF document text
    • https://vuxuminitemup.weebly.com/uploads/1/3/0/8/130874085/3ad9d81ba.pdfIn PDF document text
    • http://cabinetshub.xyz/digital_economy_act_2010_and_20172aprg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371005/normal_5fe2d3165ae02.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408464/normal_60281bf63431f.pdfIn PDF document text
    • http://profer-opt.ru/tahapan_sintesis_proteind986t.pdfIn PDF document text
    • http://kungfumalibu.com/wexilafovodemuwaps1m39.pdfIn PDF document text
    • https://rowopubogapog.weebly.com/uploads/1/3/4/2/134234702/jugiv_mukufawaxi_pajizitanosus_dedadim.pdfIn PDF document text
    • https://nimafomu.weebly.com/uploads/1/3/2/7/132710507/80ed489d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367927/normal_603b0838a9b7a.pdfIn PDF document text
    • http://vizezokope.iblogger.org/grocery_shopping_list_template_google_sheets.pdfIn PDF document text
    • https://finaxapiw.weebly.com/uploads/1/3/5/3/135301963/faxid-fisubedapizevab-weziwixofaj-dexolupikulunow.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426816/normal_5fee059086097.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485446/normal_603e8c1edc725.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e844e42f-ff2e-4bc2-8e2f-3976a1f338d8/problemas_de_salud_en_mexico_actuales.pdfIn PDF document text
    • http://guwuwujuresok.rf.gd/navy_eval_examples_e6.pdfIn PDF document text
    • http://guzimuj.rf.gd/jesuxamamoge.pdfIn PDF document text
    • http://terajupatasan.rf.gd/phytoestrogens_in_functional_foods.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6205ec08-2120-48ad-86c3-e5c48875b31a/sonozojoraxezifip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a268e40a-3b5a-4f7b-9acf-12e1a3917bea/windows_10_office_wont_open.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed67ad2b-8cae-4800-820d-4da232d3c882/seniganavafadazepuxisi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1132478-c376-4d5d-89dc-e318c84fec2d/ap_biology_textbook_college_board.pdfIn PDF document text
    • http://koxogulu.rf.gd/23211002601.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19878e85-dbae-47a9-b94a-e5fca14e3e8f/best_air_fryer_cookbooks_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80a665ab-9100-4c0d-9a1e-1281a9e397b8/what_color_reflects_light.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1eccf6a9-923d-47e4-b305-d11818c9512d/bmw_x3_repair_manual_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003dce1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DCE1 4788 bytes
SHA-256: 5acf07d2929556dd4ffaf0cffb945cb795a5fb4d8c4a92e0073e83e31df67437
font_01_sfnt_off0003ed28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3ED28 14408 bytes
SHA-256: 6011c859c4595374b188fee4fae1fad7b1606f2d4a9614ab4f87d16cc89ff360

Open this report in the interactive analyzer, or submit your own file for analysis.