Malicious PDF — malware analysis report

Static analysis result for SHA-256 e71539b4d19094ab…

MALICIOUS

PDF

84.1 KB Created: 2021-03-17 05:22:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: b840b4f2621d1d3d0f21a0b63c4a2065 SHA-1: f62780c0a779470f09dead4bc9433a48a73c0853 SHA-256: e71539b4d19094ab7abc258067aaf2ffffd1d9d5012cf2002200fad470902622
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as 'Pdf.Phishing.Trojan' and a machine learning classifier indicated a high probability of maliciousness. The embedded URL 'https://leonvi.ru/wix?keyword=happn+apk+download+for+pc' suggests a phishing or social engineering lure, likely aiming to trick users into downloading malicious software. No scripts were extracted, but the PDF structure itself contains malicious elements.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=happn+apk+download+for+pc PDF link annotation
    • https://cdn.sqhk.co/lugizumevemu/eidcgj7/mibepamuxod.pdfIn PDF document text
    • http://ladyso.ru/poxolarol0ymp6.pdfIn PDF document text
    • http://neridipazaf.22web.org/livro_sistema_bethesda_para_relato_de_citologia_cervical.pdfIn PDF document text
    • http://meriline.store/minecraft_festival_newsletterxxa3t.pdfIn PDF document text
    • http://pixunune.sportsontheweb.net/sword_art_online_aincrad_-_edio_1_light_novel.pdfIn PDF document text
    • https://cdn.sqhk.co/baxijaxazixi/tjf7PpY/86856706919.pdfIn PDF document text
    • http://mazafaka69pussy.online/fazufuvuwiwokasudepunel34vl0.pdfIn PDF document text
    • http://oyuncuxx.com/savomekh0c0.pdfIn PDF document text
    • http://tohld.in/fuximofejabork2bxx.pdfIn PDF document text
    • https://cdn.sqhk.co/zupitefa/haHhejc/new_call_of_duty_2019.pdfIn PDF document text
    • http://vasetar.iblogger.org/45671582074.pdfIn PDF document text
    • https://cdn.sqhk.co/kolokejo/8RoUihw/condos_with_water_parks_in_panama_city_beach.pdfIn PDF document text
    • http://lajodibibodi.getenjoyment.net/how_to_use_iphone_4s_as_webcam.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bulikowexunepov/what_do_u_mean_by_daring.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72a755d5-6b0f-4139-a6e5-7113f59454a7/which_egyptian_god_card_is_the_strongest.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/tedufasakojepani.pdfIn PDF document text
    • https://s3.amazonaws.com/jevopemosod/corporate_bond_market_in_india_issues_and_challenges.pdfIn PDF document text
    • http://kodadus.epizy.com/80725186540.pdfIn PDF document text
    • http://kepinud.rf.gd/tefasibexakif.pdfIn PDF document text
    • http://jizonizop.rf.gd/48718093883.pdfIn PDF document text
    • https://s3.amazonaws.com/sumesawoxajew/bumpy_ride_video_song.pdfIn PDF document text
    • http://jumawivowibeb.onlinewebshop.net/tabla_pulgadas_a_centimetros.pdfIn PDF document text
    • https://s3.amazonaws.com/tobovunoberiki/baby_beautiful_photos_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d616a93e-af88-4860-bc34-51930cb0cecb/how_to_program_spectrum_remote_to_soundbar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f552.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF552 5088 bytes
SHA-256: 81c761aab54dfe32c786d7d3f4cef11fe9858136604f6720b88f84b68a501f30
font_01_sfnt_off000106c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106C9 11572 bytes
SHA-256: 5ddda75e2281eb51a1054a632cde9d4d7e700c7331b7adff723faf9dc02a6273
font_02_sfnt_off00012db5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DB5 16144 bytes
SHA-256: f6e0f4a25f18a144688c6b7f40519a5efc98c72643b9054f89526e396d9b459d

Open this report in the interactive analyzer, or submit your own file for analysis.