Malicious PDF — malware analysis report

Static analysis result for SHA-256 239d9085d7b05ac9…

MALICIOUS

PDF

271.1 KB Created: 2021-06-10 05:39:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: e498a2efdf055e6dce33ebad4d60d834 SHA-1: e4b1c307008992b3d54282ef65a73e6bbefc42c6 SHA-256: 239d9085d7b05ac927b1ef22bb99c4cdf835cd0640296ff47f294c6c43f53896
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'catamma.ru', which is likely a phishing or malware distribution site. The document body, though heavily corrupted, contains text related to a book title, suggesting a lure to disguise the malicious intent. No scripts were extracted, but the presence of external URIs and the malware detection strongly indicate a phishing or download attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9454

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=essential+cell+biology+5th+edition+pdf+free PDF link annotation
    • https://buvosaxemapo.weebly.com/uploads/1/3/1/4/131437370/9eedd90f931.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460055/normal_6011db69c70b1.pdfIn PDF document text
    • https://namoxatiki.weebly.com/uploads/1/3/4/4/134477177/jimaritufeb-wegozido-favane.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445731/normal_6014742abdf85.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449779/normal_5fe79e74d6b9a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485946/normal_60300dc9808b9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381766/normal_60661927cc313.pdfIn PDF document text
    • https://nusomosuguxapo.weebly.com/uploads/1/3/4/6/134693055/waredajujedukod.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369333/normal_602ef8818cb12.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496389/normal_60135cfd7ff1d.pdfIn PDF document text
    • https://wudemivezetuf.weebly.com/uploads/1/3/4/3/134318680/buruselufewimot.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387699/normal_601abece4688f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474448/normal_5feba2e0dc481.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482872/normal_601db2c422b25.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368235/normal_60c1580bd9d3a.pdfIn PDF document text
    • https://pibefabetanob.weebly.com/uploads/1/3/4/3/134376782/fukulude_woxujetu_sojudoriw_fezefes.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.orgThisIn PDF document text
    • http://mejigulo.pbworks.com/f/30521833050.pdfIn PDF document text
    • http://lijunew.pbworks.com/w/file/fetch/144813567/gta_4_psp_game_free_download.pdfIn PDF document text
    • http://gibabug.pbworks.com/w/file/fetch/144690474/goluje.pdfIn PDF document text
    • http://nebapelamive.pbworks.com/w/file/fetch/144532083/50318752187.pdfIn PDF document text
    • http://dowiginade.pbworks.com/f/lubopopalo.pdfIn PDF document text
    • http://sorawako.pbworks.com/f/jakuguvezom.pdfIn PDF document text
    • http://fiwonotexo.pbworks.com/w/file/fetch/144705192/alai_payum_nenjile_album_song_download_masstamilan.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.org/In PDF document text
    • http://scripts.sil.org/OFLAbyssinicaIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003cb55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CB55 5740 bytes
SHA-256: 8915597f90561e92e72b388875f50b8398cd623e9e96fe538406fc7dccdc66e5
font_01_sfnt_off0003deda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DEDA 20968 bytes
SHA-256: 699a8b55e50cd80192193eb3832e3199d82edd581ff2a4f3bd3563cc6d5fef53
font_02_sfnt_off0003ff0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FF0F 13540 bytes
SHA-256: c73e76dfd37ee954da817a6b40187172ef5b387d08e54688012cbc55de299ca4

Open this report in the interactive analyzer, or submit your own file for analysis.