Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa100f7aa8248d97…

MALICIOUS

PDF

96.0 KB Created: 2021-03-16 20:41:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd38bebbe8dba088403358bad33ef539 SHA-1: 15ef9a023911e6c7941fc4acadd29a1475c1061f SHA-256: fa100f7aa8248d9780c610537d54ea253d7fd2e0da25142caf717d3c51cc2553
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading an application or further malware. The document body, though heavily obfuscated, contains references to 'You player tv apk', suggesting a lure for a fake application download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=you+player+tv+apk
    • https://sulasaboxa.weebly.com/uploads/1/3/4/7/134767053/0ebdc5.pdf
    • http://mrshadow.net/top_notch_fundamentals_workbook_unit_1474n4p.pdf
    • http://shoop-fk.ru/what_is_lean_canvas_templatejzir7.pdf
    • http://pobijubak.iblogger.org/how_does_it_feel_to_be_a_problem_moustafa_bayoumi.pdf
    • https://pobufulali.weebly.com/uploads/1/3/4/4/134494274/xetikunew.pdf
    • https://cdn-cms.f-static.net/uploads/4463807/normal_5fd652bace8a7.pdf
    • https://wojumujar.weebly.com/uploads/1/3/5/3/135396772/092cd864ab1897.pdf
    • http://es50off.pro/how_do_you_start_a_presidential_speechcna43.pdf
    • http://gapeveta.iblogger.org/wii_homebrew_channel_guide.pdf
    • https://lesopafewef.weebly.com/uploads/1/3/5/2/135293294/fudefifusulof_pozusosupovil.pdf
    • https://cdn-cms.f-static.net/uploads/4426425/normal_6011238d92296.pdf
    • https://static.s123-cdn-static.com/uploads/4461773/normal_5fe23c9d095ef.pdf
    • https://cdn-cms.f-static.net/uploads/4385437/normal_60387f28874e7.pdf
    • http://zzzmmmmejjj.space/there_s_a_butcher_around_jogar_onlined6yxs.pdf
    • https://sinekagu.weebly.com/uploads/1/3/4/8/134855021/gamedanoji.pdf
    • http://itdiscount.pro/el_principito_pelicula_completasw86c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c821cfb2-5280-452a-9336-14a055e64a67/72764830861.pdf
    • https://uploads.strikinglycdn.com/files/4fcb1032-829e-4826-8613-ff56ba8409e6/dubemixafozogefil.pdf
    • http://wojixefem.epizy.com/96540283850.pdf
    • http://jijetebum.epizy.com/3768409124.pdf
    • http://bowubibegejojop.rf.gd/3d_cartoon_wallpaper_hd.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00013bc0.bin
14cbf93a69700b4ecb3800c59edd2580ef1e2e3c0defea29b40655f78d7a65ea		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13BC0 30660 bytes
font_00_sfnt_off0001085d.bin
6ad49a1b4c0aa0f0173d2376b0d81b0ab89cc1b0729767762c70af77b008c8fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1085D 4820 bytes
font_01_sfnt_off000118e2.bin
8354c2ecf4d9e5edbb5efecb2d919bd37f056f269606ceb0161720eed2b9792a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118E2 10116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.