Malicious PDF — malware analysis report

Static analysis result for SHA-256 e41ce005ed26afd7…

MALICIOUS

PDF

554.9 KB Created: 2021-05-06 01:01:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1900f035ff923ad926432689634d2e1f SHA-1: 554af65747bc94a69ae01804358cc88154f72a07 SHA-256: e41ce005ed26afd7a0ecf711c6187a3b343a9f75ed43d57448d8d76b908e5f36
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, and ClamAV detected it as a phishing trojan. The document body, though heavily corrupted, suggests a lure related to a 'trophy guide'. The presence of external URIs indicates an attempt to redirect the user to a malicious site, likely for further exploitation or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5474

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=tales+of+zestiria+trophy+guide
    • https://fewefemuge.weebly.com/uploads/1/3/4/3/134372507/3811808.pdf
    • https://cdn-cms.f-static.net/uploads/4389821/normal_6021fb96b8c9d.pdf
    • http://momentikshop.space/vanaxodetijupuzl20bc.pdf
    • https://static.s123-cdn-static.com/uploads/4372373/normal_5fff92b5859d9.pdf
    • http://look-hotel.com/dibavijadipesivaraxapepq3zj7.pdf
    • http://onlinesos.tech/81248801513ew8vp.pdf
    • http://luminar4-download.xyz/dadipigoxijivanow917m1.pdf
    • https://wusaworapivuwor.weebly.com/uploads/1/3/4/6/134659128/e5d44ac8.pdf
    • http://eslivdrug.space/what_size_file_for_poulan_18_chainsawgqfzo.pdf
    • http://sikakapu.medianewsonline.com/acknowledgement_for_internship_project_report.pdf
    • http://digitaltoolsfor.xyz/fijamiditasetomapiguni2wiem.pdf
    • https://cdn-cms.f-static.net/uploads/4426418/normal_6012c5e403825.pdf
    • http://vigastlens.xyz/betewvhgdg.pdf
    • http://moneyindia.site/395290389952u70.pdf
    • https://tuxitusonodedin.weebly.com/uploads/1/3/0/8/130873989/84f5408cf3.pdf
    • http://womizepivilora.sportsontheweb.net/80599484045.pdf
    • http://zibepifutidi.sportsontheweb.net/81532388391.pdf
    • https://cdn-cms.f-static.net/uploads/4386848/normal_5fd1577c0f503.pdf
    • http://zugapuvu.mywebcommunity.org/cannibale_didier_daeninckx.pdf
    • https://cdn-cms.f-static.net/uploads/4471509/normal_606e55ae6a46c.pdf
    • http://xelamoxadavas.mywebcommunity.org/episiotomy_procedure.pdf
    • http://boldly-grow.com/outlook_email_template_builder53uba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://muvamubas.atwebpages.com/81647504937.pdf
    • http://fabevax.myartsonline.com/fundamentals_of_financial_accounting_book.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0007f0c6.bin
5c5850f57d60532f2d6bd1069f0c6ed04badc3e637d125f25fb65a00c85d8e0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F0C6 12112 bytes
font_01_sfnt_off0008183e.bin
8a619c5c25be5ee594515e29c6fc02fff5efe15db177491aedac970be8027a15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8183E 5180 bytes
font_02_sfnt_off00082a0b.bin
4cd463ac3fbccfb2c7974a0c86b3bbe5795855357a96d135c71b8067a3c501a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x82A0B 29208 bytes
font_03_sfnt_off000875c7.bin
66f1346a789a1b260b094ed00130362207567db1bdf14030bbf17b5b4ba904fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x875C7 16264 bytes
font_04_sfnt_off00088b51.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88B51 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.