Malicious PDF — malware analysis report

Static analysis result for SHA-256 09333cc5266cff41…

MALICIOUS

PDF

68.8 KB Created: 2020-12-11 08:50:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 61f13a563be662a1a35981b4cd810d13 SHA-1: 9dde4b815710f74b6cb65847d88724d476fed11b SHA-256: 09333cc5266cff410ade844f49a8e066d35a308414b392a7ab2bb2e75d7863dc
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that directs users to a suspicious domain, masquerading as a download for a weather application. This URL is the primary indicator of malicious intent, suggesting a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly support the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=yahoo+weather+app+apk PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc15fe03dfdd95b60d86875/t/5fc92609d7b59130cce96b6e/1607017995030/43564154378.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75077b0f-ff7c-4449-b448-793246ab63d8/95702414698.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/161fcef8-6372-421d-a5fe-db3890daf076/behzat__96._blm_bipsiz_tek_para_izle.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd195595-eb2d-44e2-aa0a-f79c9692332a/81174282768.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0866553d-49e6-4b63-823a-6bd73c1d25d4/vutovekika.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4f2670a2757459bfcd987/t/5fcfa6938b174454e9a8dfb7/1607444115817/jagebefeve.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd30f39b414e3f53aaeef6/1606234356275/taletukumeref.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2ac42a5bc066edfb10807/t/5fcaa4eedd8a8730b06fd84a/1607116014896/34517672819.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0dc232cf09257bd6bd446/t/5fd0a542125f6a657a519c28/1607509317572/97420077197.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc066c960f2895dc1e54813/t/5fc1188f5147b148045ab449/1606490256600/que_significa_apologetico_en_espaol.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc529d86609fd0ee7ad3c2c/t/5fc96a521d298d74ff89bedf/1607035475982/epic_games_launcher_won_t_open_on_laptop.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e99fa13a450babf41659/t/5fc43ace3570fb44d18904ae/1606695632817/the_beauty_space_krakow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/866a2536-99b2-42c3-a9c6-ebca2ce0de9c/gokikanabubuvut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d62a3bef-12a9-4de7-bd2c-97f0607b1371/duval_high_school_aerospace.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d18f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD18F 4816 bytes
SHA-256: 2ab4f669e552676e42610e77c1953647aafd7dad537f704bf42ae75beea5f317
font_01_sfnt_off0000e1fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1FD 11000 bytes
SHA-256: 9eac9c5fde6f3a8b37fcf6f66a8be09d45d8108d91e3e025b9631d3531ac63e6

Open this report in the interactive analyzer, or submit your own file for analysis.