Malicious PDF — malware analysis report

Static analysis result for SHA-256 18fef8dbc883f341…

MALICIOUS

PDF

93.3 KB Created: 2021-05-30 18:21:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 365eeaaa1756a112b18af49f64013a75 SHA-1: 7ed5778d2b395f568be411617e86ff7cb07a6215 SHA-256: 18fef8dbc883f3411965b0a665c51553983f774455f833ac7be27b35fce64a05
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by ClamAV as a phishing trojan. The ML classifier also strongly indicated maliciousness. The document body is heavily obfuscated, but the presence of an external URI suggests an attempt to redirect the user to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=las+otras+puertas+abelardo+castillo+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4367273/normal_602141850fdc6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377905/normal_5ff7a1c8daf21.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490371/normal_60100e497546d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410448/normal_603c2fa84da74.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368489/normal_5fd660952e5a6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368762/normal_604d21e10dcfc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495387/normal_6048e4a97b25d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375355/normal_602d9c1f84b07.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4530323/normal_60660936ed077.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4372384/normal_60b07bb5d3995.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420764/normal_6031ce177904a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460477/normal_602e4c2aa42db.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ceaa60a0-080c-4b70-8386-12cf3e951dac/ejercicios_identidades_trigonometricas_1_bachillerato.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0974b43c-d2c8-4de7-9481-2802ac3513ec/how_to_get_started_swing_trading.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a2c5890-e8e1-4aa8-ae2e-40317a59b550/how_to_thread_janome_new_home_sewing_machine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/695c8a5c-8f38-45c2-91a2-b1743fe3ac00/voloz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51175481-6534-4b5d-a390-93ead1bdd16d/advanced_vba_programming_books.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfc1f37f-2c5f-4d14-9bc9-b19a67d62c36/40540622878.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd3d61ea-3bfa-426c-84d4-4d1743de8eab/rudidufosilatoxapazenido.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd57057b-8b9d-4aef-ae53-94eb7f3dbfe6/quimica_organica_formulacion_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c1156de-79ff-4fa1-a314-ceeacafe4e7a/runosekukiporobivaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40a5dc38-f622-42e7-b13a-3ff7b89095ff/el_conde_lucanor_cuento_24_resumen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ba367af-b5a6-44da-86e2-b0dee4bef2a4/6822147417.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012af7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12AF7 5228 bytes
SHA-256: 9a50d8c14b2dfc591ed54d8c48ebd6082a381ddb8c5b13ba15f42c308666125e
font_01_sfnt_off00013cc9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13CC9 12732 bytes
SHA-256: 9e57bf9946d2b78a5adc0c76e235be5d1260f85be69821f84538bc1a58805dea

Open this report in the interactive analyzer, or submit your own file for analysis.