Malicious PDF — malware analysis report

Static analysis result for SHA-256 14d9357e3c784cdd…

MALICIOUS

PDF

65.5 KB Created: 2021-03-16 19:18:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: ff43f635f9c69222292c83f1fd680e3a SHA-1: 7a780f1c0921da167aaff0626f6d006da3efbedc SHA-256: 14d9357e3c784cddb9c72ac704068c57757d98cb420becbbc7532aa12dc91e9c
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a lure related to 'weight training worksheets for middle school' which redirects to the URL https://pelibifir.ru/wix?keyword=weight+training+worksheets+for+middle+school. This URL is likely used for phishing or to serve a second-stage payload. The PDF structure and embedded content suggest it's designed to trick users into clicking the link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=weight+training+worksheets+for+middle+school PDF link annotation
    • https://cdn.sqhk.co/zofizitene/fjbhdsI/samurai_flash_apk_mod.pdfIn PDF document text
    • https://cdn.sqhk.co/xonipavu/KLahhWY/neil_diamond_greatest_hits_2020_cd.pdfIn PDF document text
    • https://cdn.sqhk.co/kugefaxeker/ijkSjXJ/banner_maker_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/najiligopej/yijeZVQ/nibokama.pdfIn PDF document text
    • https://cdn.sqhk.co/donaxewon/g3IYLwh/consumer_reports_top_loading_washers_2017.pdfIn PDF document text
    • https://cdn.sqhk.co/tokarikadez/KQCgigj/90619999657.pdfIn PDF document text
    • https://cdn.sqhk.co/sidogorego/hu8hd7Q/beat_the_boss_3_unblocked.pdfIn PDF document text
    • https://cdn.sqhk.co/sizafutito/hbIgeU4/magic_tape_reviews.pdfIn PDF document text
    • https://cdn.sqhk.co/zamepeja/bU8jbhd/samsung_level_u_pro_anc_specs.pdfIn PDF document text
    • https://cdn.sqhk.co/sifilefu/YhcRjc0/baxanan.pdfIn PDF document text
    • https://cdn.sqhk.co/kawiwitifa/jjj6jcZ/54579062241.pdfIn PDF document text
    • https://cdn.sqhk.co/jopuromug/Lb6Chcw/vikings_at_war_gameplay.pdfIn PDF document text
    • https://cdn.sqhk.co/pazoxini/heM1H8t/aacs_decoding_library_vlc.pdfIn PDF document text
    • http://worelimupuvefam.mywebcommunity.org/31850691106.pdfIn PDF document text
    • http://bupitubegedew.getenjoyment.net/73176577630.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fef7259-c57a-46c1-909b-4a179ef7b5d0/is_it_worth_replacing_a_refrigerator_compressor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/169281b7-6cd9-4fdb-b0c7-280fb37d591a/terrova_i_pilot_link_manual.pdfIn PDF document text
    • http://firiwigisu.atwebpages.com/81481071935.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c2f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2F4 5604 bytes
SHA-256: 987e4ef509da77dfd7925d80c881ec86117dde6545dad4eda83a8d82705dda1b
font_01_sfnt_off0000d5f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5F5 9620 bytes
SHA-256: 3880d79feacfa5b34d1f111c4ad0476f0c88694593b456135ce71198f25f3aa9

Open this report in the interactive analyzer, or submit your own file for analysis.