Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2bfc9354eb85bb4…

MALICIOUS

PDF

97.0 KB Created: 2021-01-26 22:52:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 7f41d46a3ad603f46ae3440ea720df22 SHA-1: 5c641a1cb6b18c16cc88504873ba8ad5b67ce5fb SHA-256: f2bfc9354eb85bb4083874efc3a00c61b6f8a3795db743fed1e9e72c7ef28cca
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs that mimic search results for game downloads, a common lure for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to trick users into downloading a malicious payload. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wb?keyword=castle%20jungle%20world%20run%203%20download PDF link annotation
    • http://lnstagram-blue-ticks.com/skull_live_wallpapers_for_iphone_free60lwe.pdfIn PDF document text
    • https://rewovokikulige.weebly.com/uploads/1/3/1/3/131379935/3733490.pdfIn PDF document text
    • https://votozugilom.weebly.com/uploads/1/3/1/0/131071295/zasefidefe.pdfIn PDF document text
    • http://xekumaluvox.iblogger.org/beautiful_html_forms.pdfIn PDF document text
    • https://repugololenip.weebly.com/uploads/1/3/4/8/134880500/4965981.pdfIn PDF document text
    • http://nuverlites.online/rakenutizowarapokofixewink2pgi.pdfIn PDF document text
    • https://rutejiredoratel.weebly.com/uploads/1/3/1/3/131383841/8478244.pdfIn PDF document text
    • http://xtrading.buzz/23820328120ks5nf.pdfIn PDF document text
    • http://fullpisetc.ru/just_dance_2019_bang_bang_bang_vipisdn9.pdfIn PDF document text
    • http://justiciaforjustice.com/jegabugiwejaxovatuli402rt.pdfIn PDF document text
    • http://obsluzhivanie-kompyuterov.moscow/god_kings_gameplaywyu1h.pdfIn PDF document text
    • http://center-san.ru/26576871356k9yf3.pdfIn PDF document text
    • http://podipotekoi.ru/davekuxexovewugakuveroqood5.pdfIn PDF document text
    • http://sovetnik53.ru/bottle_shooter_game_download_for_pckolu3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rurovikejigibu/mijifatidexet.pdfIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/xifox.pdfIn PDF document text
    • https://s3.amazonaws.com/kujapomib/rationalize_denominator_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/65319145808.pdfIn PDF document text
    • https://s3.amazonaws.com/jewizopukuni/diagnosis_of_hepatitis_c_virus.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00013cb1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13CB1 31076 bytes
SHA-256: 41d917ac23a914e74e06d85e139994fa8630e519f449e0b2c873691d8ad49c89
font_00_sfnt_off0000fbae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBAE 2888 bytes
SHA-256: f7c768458a26e9ef562858d01fa00611e0c7310d4e9849af27157a7c321f0ba5
font_01_sfnt_off000105f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105F0 5232 bytes
SHA-256: 67e64c620eab2bda764110dae1257f48cc0c75eab62ac0ee1f724e8d853c5e5a
font_02_sfnt_off000117de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117DE 10664 bytes
SHA-256: 0fb3ab506a93267eaa9b85a2fee06005159dc7e475bc49025eb76da74422b4f5

Open this report in the interactive analyzer, or submit your own file for analysis.