PDF malware analysis — malicious · e4d9fb58159ee118

MALICIOUS

PDF

10.36 MB Created: 2024-09-03 19:13:13 +00:00 Authoring application: Canva

MD5: 35dd2ebdaca625f397e0be0705acec0a SHA-1: b793a963dc4063b2481b79974906c3e9f9533b3c SHA-256: e4d9fb58159ee1189b286fc3cabde1bf180ebc46c01e78c6e41656b7a0d00cb2

68 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment

The PDF contains embedded JavaScript and critical heuristic firings indicating the use of invisible and repeated links to deliver a payload. The primary URL points to a RAR archive hosted on Dropbox, suggesting a downloader or droppper mechanism. The lure appears to be related to 'The Wolf Among Us 2' promotional materials.

Machine Learning

Nyx PDF Classifier clean score 0.1069

Heuristics 2

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.

URL https://www.dropbox.com/scl/fi/4b0qoxs096pbwp1tlw2oy/The-Wolf-Among-Us-2-promotional-materials-for-YT.rar?rlkey=39ifbdt7v6gsutyvf5gxwspnq&st=xwkdu08h&dl=1
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_000_off000005f5.bin` `9d5ecda79238922206f0e61b21252f3d64a8550546506b0115cfbe7bd4ce2446`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5F5	4194304 bytes
`stream_001_off0057d667.bin` `95f8e7551e9070a12f44bf0242db8453b22d6022b050d300acd591f17f413487`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x57D667	542058 bytes
`stream_008_off008c8144.bin` `d50433d3e4a6f81063aaee576ab1dafa17b976c227cf207522d0fb8da042a07c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8C8144	180686 bytes
`stream_009_off008d3346.bin` `242f8689b96b5a7f13913543fbd759ceae7cb668852be0011a81af4885d60374`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8D3346	4194304 bytes
`icc_00_off008c7f13.icc` `d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d`	pdf-icc-profile	PDF ICC profile at offset 0x8C7F13	536 bytes
`font_00_sfnt_off00a5a86a.bin` `6c577beae95d14d5b4a874cb5823df247a9785c90c23cb5668360e201384fa12`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA5A86A	7312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.