Malicious PDF — malware analysis report

Static analysis result for SHA-256 f694627378895cfd…

MALICIOUS

PDF

70.7 KB Created: 2021-05-29 01:15:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 181f70f4a1b2212e6d431dc1d3503345 SHA-1: 660fc46a28257e48fa8f144cfda4804dc5faeb88 SHA-256: f694627378895cfd0730c359d992a34b03f0b88b3e29f8fa51a34c3b08e37d17
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was identified as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL suggests a lure for downloading a modified application, likely a game, which is a common phishing tactic. The document body, though heavily obfuscated, contains references to 'Dawn of titans mod apk 1.40.2', reinforcing the lure theme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/cba92875935143b1ec915d85c2541172/vufepozowomavenuza.pdf
    • https://newat.ru/wp-content/plugins/super-forms/uploads/php/files/ba70a97d700cafa8ec86b7d419ce763d/74373031045.pdf
    • http://wbbray.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a1e647850e---fenegajamabe.pdf
    • http://www.zav-mito.si/wp-content/plugins/formcraft/file-upload/server/content/files/160ae77ca7da03---27295637713.pdf
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/15b0f79c8bde62a11048b86066b86596/bewejofizomanogebosetod.pdf
    • http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093b21c5b1a3---vaxadafebopoze.pdf
    • https://jodhpurtravels.com/nbloom/fckuploads/file/revakiborabanoxada.pdf
    • http://imagespa.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1607a186ac3388---guwadulutiser.pdf
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/9gl33p1jkbq19leh9qobcdn96f/felen.pdf
    • http://mirandatutoringcentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607cb82ebcc83---botowujolegafovubeti.pdf
    • https://liniagdanskzydowo.pl/files/rozebux.pdf
    • http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16071d284e73eb---12464498150.pdf
    • https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/c689f9642e001373622a5fa97e196f69/demobozogozakajewevowepo.pdf
    • http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/16096b3b3af8d5---52944660680.pdf
    • http://reclaimsplus.com/wp-content/plugins/super-forms/uploads/php/files/32dceb1a38a716e2abf57ef2e06cfb0d/51670577968.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=dawn+of+titans+mod+apk+1.40.2
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d34e.bin
ec57a7712194df384f34c8a33b8de3d9ef6d92437124b9c6e179a1f64e9180d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD34E 5660 bytes
font_01_sfnt_off0000e6b7.bin
3b65015d0c701f0926ad95be234515e50d21868ffc048582fc58cf5eb47d823c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6B7 10964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.