Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcc12f4494e9a377…

MALICIOUS

PDF

76.7 KB Created: 2021-06-02 23:23:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c0f9d646421f14f4269edd42415d21f2 SHA-1: 2e761eafa0e3c0790faf48e72e935a94bf4ab0ff SHA-256: fcc12f4494e9a3776c81a2aff3179649719bc0425ea2661e35aba30a89130c8c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search result for a game download, indicating a social engineering lure. The presence of embedded URLs and the nature of the detection suggest an attempt to trick users into visiting a malicious site, likely to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/pbw?utm_term=wwe+smackdown+here+comes+the+pain+free+download+for+android
    • https://kogoporerosuf.weebly.com/uploads/1/3/5/3/135322240/9958521.pdf
    • https://gipurafesab.weebly.com/uploads/1/3/1/6/131637457/razonupeno.pdf
    • https://rojofasefimo.weebly.com/uploads/1/3/1/6/131636828/fee15c8447fd.pdf
    • https://cdn-cms.f-static.net/uploads/4411916/normal_5fd1778aecfc2.pdf
    • https://cdn-cms.f-static.net/uploads/4446642/normal_6024ef67c5c2b.pdf
    • https://kelodulelonax.weebly.com/uploads/1/3/4/6/134644310/fbdebc9370d5c2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wuxikadafi.pbworks.com/w/file/fetch/144420903/is_there_an_equalizer_for_spotify.pdf
    • http://viluxese.pbworks.com/f/contoh_judul_skripsi_akuntansi_pajak.pdf
    • https://uploads.strikinglycdn.com/files/8ae212a7-962f-4dff-8225-b7f3526297b8/gaboze.pdf
    • http://sufizilofab.pbworks.com/f/what_is_capsule_filling_machine.pdf
    • http://paderukut.pbworks.com/f/avital_7111l_remote_start_instructions.pdf
    • http://lekipirunezi.pbworks.com/f/why_am_i_not_getting_all_my_freeview_channels.pdf
    • http://fagimox.pbworks.com/f/dudufewetoxaligazewitiget.pdf
    • http://kekirow.pbworks.com/f/does_sauna_belts_really_work.pdf
    • http://siruzosu.pbworks.com/w/file/fetch/144446715/how_to_install_dlc_gta_v_ps3.pdf
    • https://uploads.strikinglycdn.com/files/4a8ebe75-ee36-47f3-9729-373d85a29a3a/58701573884.pdf
    • http://gazumadu.pbworks.com/f/82732134899.pdf
    • http://paderukut.pbworks.com/f/download_wwe_2k16_for_pc_highly_compressed_99mb.pdf
    • http://mudowomuxexo.pbworks.com/f/pijejodesafa.pdf
    • http://bupataved.pbworks.com/w/file/fetch/144427932/nasuwesin.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ead7.bin
e3709b73d03fe3ec4b335d1ef04d43961ec172860428509312b56ac1a822d367
pdf-font-stream PDF embedded font (sfnt) at offset 0xEAD7 5564 bytes
font_01_sfnt_off0000fdb1.bin
112b26fc88950e1d5114620bbd3d055b8ef08b3baeca6775256b838c263d2c2e
pdf-font-stream PDF embedded font (sfnt) at offset 0xFDB1 11668 bytes