Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4b3fd649b4e1a9d…

MALICIOUS

PDF

82.7 KB Created: 2021-03-20 17:48:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b9ed4b68367d87c265e50e6ec7a1b4a7 SHA-1: a693742d1cdf77db0cee379b9e4c406a1002ca8a SHA-256: e4b3fd649b4e1a9daf79139dd15b3bdfc1efc1aece4d404c28d843832b185958
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing lure for an Android application. No scripts were extracted, but the presence of the external URI is a high-confidence indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=olx+ph+4.8+apk
    • https://static.s123-cdn-static.com/uploads/4446925/normal_5fc8d45eee5eb.pdf
    • https://cdn.sqhk.co/sivojadirabe/FHih61E/47773642657.pdf
    • https://static.s123-cdn-static.com/uploads/4402956/normal_5fe285b47e319.pdf
    • https://cdn-cms.f-static.net/uploads/4366993/normal_60166a25dbe45.pdf
    • https://cdn.sqhk.co/duxadikoti/iheyInf/wormate._io_gra_poki.pdf
    • https://cdn.sqhk.co/tinupolureg/jchaijO/39014253484.pdf
    • https://cdn.sqhk.co/xanikadir/hbiborN/loleguwubasudojokevoxu.pdf
    • https://cdn-cms.f-static.net/uploads/4420431/normal_6021404be858d.pdf
    • https://cdn.sqhk.co/xevuvuxene/ibhafgf/car_racing_tracks_in_australia.pdf
    • https://cdn-cms.f-static.net/uploads/4462992/normal_60328e949f8b5.pdf
    • http://wimilarudiza.iblogger.org/how_to_pair_plantronics_wireless_headset_to_computer.pdf
    • https://cdn-cms.f-static.net/uploads/4367925/normal_5fd3865d9801c.pdf
    • https://cdn-cms.f-static.net/uploads/4443292/normal_5fd32719e0a23.pdf
    • https://cdn-cms.f-static.net/uploads/4376120/normal_6048c9beefd13.pdf
    • https://cdn.sqhk.co/jomububorava/dhil8gc/hoverboard_racing_car.pdf
    • https://cdn.sqhk.co/josipinu/ckKeDji/drop_waist_inches_fast.pdf
    • https://static.s123-cdn-static.com/uploads/4489615/normal_5fdd36d4e4e2a.pdf
    • https://cdn-cms.f-static.net/uploads/4495043/normal_604610a106320.pdf
    • http://zabovawupe.mypressonline.com/nologepofetipux.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zesugipove.onlinewebshop.net/sokepepulotipowexunaxew.pdf
    • http://bomigezi.epizy.com/final_fantasy_xv_armiger_guide.pdf
    • http://dimizisunope.epizy.com/sozaluzetimiraneboxifagu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec85.bin
0c4482cf581fb879758fae1250552a9b434af635d6a7e42089bc0b1da65f664d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC85 5104 bytes
font_01_sfnt_off0000fded.bin
ca61bf70af2b879a5b349be9685fb2f91839bf3e43ca149f646093a85d346487		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDED 12584 bytes
font_02_sfnt_off00012563.bin
0d96d21b48aa18e1743608b4a00dae2b54406dfe1c91682873a9df601faf1bae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12563 16776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.