Malicious PDF — malware analysis report

Static analysis result for SHA-256 e97187b645719af8…

MALICIOUS

PDF

90.9 KB Created: 2021-05-20 04:45:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 5b766a80513268046da81a759f560106 SHA-1: d759f215bd3b0bd88c95fd226269adbd21d33f96 SHA-256: e97187b645719af8e9773fcf8f77dcfade30b78564196625e735ce4e34b6449a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The embedded URL points to a resource that appears to be a lure for downloading a compressed application, likely a game, which is a common tactic for distributing malware. The document body, though heavily obfuscated, contains references to 'apk data highly compressed' and the authoring application, suggesting a crafted document intended for distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=asphalt+8+apk+%252B+data+highly+compressed PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4481056/normal_5fe2ef6fa90a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401558/normal_5fd1c6476ce19.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408170/normal_603af591a6b32.pdfIn PDF document text
    • https://noremovex.weebly.com/uploads/1/3/4/8/134883944/6f7544fa.pdfIn PDF document text
    • https://labimatejodo.weebly.com/uploads/1/3/2/3/132302966/kelibego.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407327/normal_60556eb999dcc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460680/normal_5ff4a1e9ccbcc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416490/normal_6007e18652f2c.pdfIn PDF document text
    • https://tusujowifavenag.weebly.com/uploads/1/3/1/4/131453847/6d9edb3f9accb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485576/normal_6063576ed3a6e.pdfIn PDF document text
    • https://tavazefemaxi.weebly.com/uploads/1/3/5/9/135966092/silagimedekuduwobij.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501634/normal_6036001b069bb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4544223-3045-4fa2-bf42-8682761097b0/41453265346.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3cc73d21-677f-43ca-8885-f848ca6bc6ae/28938833094.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/648d24a9-bee7-4084-ade7-462f3b00f91e/23362361001.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9700d0e3-f8f5-4631-8ad4-7a9b08b0461f/list_the_main_differences_between_arteries_veins_and_capillaries.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3FD 14388 bytes
SHA-256: 921e36735dac9b4c7cbcd432bcd1541e1cd7d879b8e0a0ac1a8cbef3af20bdc0
font_01_sfnt_off00012224.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12224 5836 bytes
SHA-256: 5b9334215510d6348c3ea99f611f226b1d60d4f737a86a94a16bdb758abdf04d
font_02_sfnt_off000135e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x135E0 11228 bytes
SHA-256: 6a2b6c7cfaf926e0b78b091abedf66eff5957c94cb93b01f6eab316ebd85e49d

Open this report in the interactive analyzer, or submit your own file for analysis.