Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4af65f137648a35…

MALICIOUS

PDF

100.7 KB Created: 2021-01-06 10:19:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: a2181ce3f84b8061dede076b6914940f SHA-1: 21adb7654bc32b7796f46079c5fb1b82745eed87 SHA-256: f4af65f137648a354b8a0e36e5c01d944d1c2927eac854bbff105ac172a60aa2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, with a specific detection name indicating it's a phishing trojan. The embedded URL points to a page about 'premier league fantasy gameweek 35 tips', suggesting a lure to trick users into visiting a potentially malicious site. Although no scripts were explicitly extracted, the PDF structure and the nature of the URL suggest it's designed to redirect users to a phishing or malware distribution point.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/wb?keyword=premier%20league%20fantasy%20gameweek%2035%20tips PDF link annotation
    • https://cdn.sqhk.co/mazavanov/PifQjdB/sea_chest_size_calculator.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424341/normal_5faee7549d3ad.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4462727/normal_5fcaa3f8a498c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416136/normal_5fd8d2227afc7.pdfIn PDF document text
    • https://cdn.sqhk.co/palevisi/ijgjjcg/togelo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470679/normal_5fe467f02d033.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484812/normal_5feb33f890d45.pdfIn PDF document text
    • https://cdn.sqhk.co/naketego/4ygjjED/princess_pretty_girl_dress_up_games_unblocked.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e68a9ad-7e14-4981-a160-0e6a028edbb5/ee_topics_for_psychology.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b3b4381-6105-460c-83ff-d5bb9f891592/lewebenowogasinalix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/060be6b1-d4df-4071-8233-1a4b560cfb1e/rumogalirazikufiwenapa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea20ec47-f583-413c-b203-8955d7ce2910/final_fantasy_iii_ds_rom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6977137e-8506-4816-9bc4-465f57511101/electric_guitar_body_templates.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e397.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE397 6832 bytes
SHA-256: 8754c72e8c0f7b3401ea661cc2653fbd662acea6fa1010d206a71130c1fe0c2e
font_01_sfnt_off0000f4e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4E7 5768 bytes
SHA-256: 5f142896b6ee998960ba5f2067c4bf36e53f92b69884318e6e2b2b84c4549dd1
font_02_sfnt_off00010890.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10890 17956 bytes
SHA-256: 338f65b303b507cf8038e92bc1d1b06213618f43a9c4aab019bfd51691359854
font_03_sfnt_off0001399a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1399A 12200 bytes
SHA-256: 0d6584d771cd49c191e9bd9aab97b56f10d0ad3ad0a843df17936d76881bcb38
font_04_sfnt_off000162c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x162C4 17084 bytes
SHA-256: 6f2dc541ce20e4238c4b91c8afb4a2654e1ea3cfe53eb58eada0a57cd0395b1d
font_05_sfnt_off00017b60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17B60 1736 bytes
SHA-256: 551918360585b1590efa6fd2a215345b2f702067d151a0e4b48cfa7490b57960

Open this report in the interactive analyzer, or submit your own file for analysis.