Malicious PDF — malware analysis report

Static analysis result for SHA-256 f54ecaf08a29e563…

MALICIOUS

PDF

80.7 KB Created: 2021-06-06 07:57:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: db7719bc096afe8a99c33162dbead803 SHA-1: 5ca62813b346266d77046badedf685e33def7acf SHA-256: f54ecaf08a29e563112d7148ffa8df19ff8bd706701f80681e24525937dfab32
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains references to 'kgf chapter 2 tamil movie download tamilrockers', suggesting a lure for pirated content. The embedded URI points to 'infrive.ru', likely a phishing or malware distribution site, which is consistent with a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=kgf+chapter+2+tamil+movie+download+tamilrockers PDF link annotation
    • https://sitimewodojex.weebly.com/uploads/1/3/1/8/131856527/kasugininafewoton.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4502439/normal_6047e70655914.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489247/normal_600923d29a4cd.pdfIn PDF document text
    • https://japafapu.weebly.com/uploads/1/3/1/4/131437770/kejop_pawobab_gofoxepakepe_kudoloxipevuru.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405419/normal_5ff50c8a0a061.pdfIn PDF document text
    • https://tediresul.weebly.com/uploads/1/3/5/3/135345321/9747711.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411921/normal_600074431cc88.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426957/normal_5fe3ecdae8248.pdfIn PDF document text
    • https://jinezosibe.weebly.com/uploads/1/3/4/4/134454760/litazi-madanebanoxaxej.pdfIn PDF document text
    • https://sozotamuluz.weebly.com/uploads/1/3/4/4/134496452/65b8d09b941.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491433/normal_5ffb372591803.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378846/normal_602d8024caae5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483867/normal_6016900dc10b8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454041/normal_60baaf4c6a38c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427793/normal_5fd60286467fe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483070/normal_5feb4e985fc92.pdfIn PDF document text
    • https://fizakilugoleji.weebly.com/uploads/1/3/1/4/131438405/renusabokapexo_duraf_nobozidokumuzoz.pdfIn PDF document text
    • https://zisamezasebav.weebly.com/uploads/1/3/3/9/133997726/petogulo-butenibijoxos-xevugup-revupile.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484631/normal_5ff77203eac5c.pdfIn PDF document text
    • https://zetodimamewiwek.weebly.com/uploads/1/3/2/3/132302859/317ecf5966.pdfIn PDF document text
    • https://bogibopedazite.weebly.com/uploads/1/3/4/0/134018154/a47eabf0160fd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381321/normal_60112877901c4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mefijunov.pbworks.com/w/file/fetch/144704838/61789110778.pdfIn PDF document text
    • http://seromazu.pbworks.com/f/40961284579.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC8C 5884 bytes
SHA-256: e037571d66311604add48a8ec6bc6f4e1add3e9135ccd44eb8cb38fb273b9ed4
font_01_sfnt_off0001108f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1108F 10588 bytes
SHA-256: 57fda0b6e5f2a3b1dff450316cfd21f705897a98bb73cfc7b0691f6e4c7255eb

Open this report in the interactive analyzer, or submit your own file for analysis.