Malicious PDF — malware analysis report

Static analysis result for SHA-256 eceb50615ac4d7c0…

MALICIOUS

PDF

74.2 KB Created: 2021-03-15 06:12:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0927e2d5e8b3406092da23a149150f1d SHA-1: ed531d1f161e1abc406ab507b74ef38d58bf62e6 SHA-256: eceb50615ac4d7c0a52203fdd17a8e01aa8157c27d9fb67a74eedcc17ae734a0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that points to a suspicious domain, likely intended to deliver a malicious payload or redirect to a phishing page. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily corrupted, suggests a lure related to unlocking PDF files, which is a common tactic for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=pdf+file+unlocker+apk
    • http://nout-prokat.website/28391282260g91hb.pdf
    • https://keduwiwisa.weebly.com/uploads/1/3/4/4/134486116/794a1f7b858df.pdf
    • https://cdn-cms.f-static.net/uploads/4446270/normal_6042c7fcbfad8.pdf
    • http://ighelperscenter.com/nugizozurutikapir0v.pdf
    • https://fukoxifixe.weebly.com/uploads/1/3/4/4/134460993/xodawapizifanogiso.pdf
    • https://nedotumawu.weebly.com/uploads/1/3/4/6/134626041/ebce68187c.pdf
    • https://cdn-cms.f-static.net/uploads/4445868/normal_603d2f2eecb43.pdf
    • https://cdn-cms.f-static.net/uploads/4495395/normal_601a0a7b00c94.pdf
    • https://gipenozup.weebly.com/uploads/1/3/1/0/131070487/9e195e22.pdf
    • https://milubede.weebly.com/uploads/1/3/4/3/134349056/fokepavile-kepowipozodo-vabuwawazapuves-verupol.pdf
    • https://duketexu.weebly.com/uploads/1/3/4/7/134725944/963ab205577e2f.pdf
    • https://static.s123-cdn-static.com/uploads/4454544/normal_5fced1a89e205.pdf
    • https://kuweperiti.weebly.com/uploads/1/3/4/9/134904821/pusasudaxap.pdf
    • https://cdn-cms.f-static.net/uploads/4409409/normal_60179621cfe56.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/labitajaxatufib/sat_2020_practice_test_10_answers.pdf
    • https://uploads.strikinglycdn.com/files/b12850fb-db15-4e90-b882-d1fd6d2331d1/law_of_universal_gravitation_worksheet_7-1_answers.pdf
    • https://uploads.strikinglycdn.com/files/4996c698-cc15-4052-9278-d3d30d7f3b8f/bazonujerepisozunul.pdf
    • https://s3.amazonaws.com/nodetuxapabara/gasevifeguzorufuw.pdf
    • https://s3.amazonaws.com/salade/zuxipeda.pdf
    • https://s3.amazonaws.com/potamotaz/finding_nemo_full_movie_sub_indo.pdf
    • https://uploads.strikinglycdn.com/files/8c268dcf-9acb-4db5-bd14-832e77eaa023/bujubanotaximo.pdf
    • https://uploads.strikinglycdn.com/files/801eb1e8-d887-49a3-a615-af7650d5c697/67391717586.pdf
    • https://s3.amazonaws.com/mupukesunobaga/how_do_plants_help_to_reduce_global_warming.pdf
    • https://uploads.strikinglycdn.com/files/ffd22a2b-4d9a-4e43-83a5-fe0144f0c32f/96_ford_ranger_electrical_issues.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e68b.bin
1393592ac42305b38b34fcbebf3b385720c19741bde926d6bf104b2ed5356df6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE68B 5036 bytes
font_01_sfnt_off0000f7c1.bin
1cf83f6409dd904ecf3d7ceed9895f4f41b1d7ec16e9e08b936d826afbf66782		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7C1 10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.