Malicious PDF — malware analysis report

Static analysis result for SHA-256 2991a5e262ff6389…

MALICIOUS

PDF

73.4 KB Created: 2021-06-06 03:00:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: c3ec2be660fe35cec61df6240788079b SHA-1: 517bf773431e22fbe165c14e759c3ad817bf5fb0 SHA-256: 2991a5e262ff6389c047ad4ddf8c79bbd5f4f718bbdcdac2da43cd4e0337ce42
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'coretry.ru', which is likely used to deliver a malicious payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to a 'genetic mutations worksheet answer key'. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/pbw?utm_term=genetic+mutations+worksheet+answer+key+biology PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4410006/normal_5fe83d6d8a75c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404969/normal_5fca2135c80a5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414336/normal_5fee70d7dd845.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2a1ed81-bcb8-4e58-b4d0-ac84a214afb4/project_quality_management_plan_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b0b29ac-5960-4063-9e99-029ec187ff60/86565967814.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/028160f1-1853-4a4a-8d44-7e67eaf99e7c/85913780938.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f244f804-adfa-43c0-9aac-bd4b5184412f/the_practice_of_everyday_life_michel_de_certeau_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e24a2580-2cc5-4b26-b520-1448bf332c51/barenoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e205d322-785c-436a-9a34-ec8e0ec58ad0/best_modern_flight_combat_simulator.pdfIn PDF document text
    • http://bofamawetodo.pbworks.com/w/file/fetch/144566859/problemas_de_sistemas_de_ecuaciones_no_lineales_4o_eso.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12f23529-e480-4312-b599-eabe7c6f62f7/dukavunorimipujadiwap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae7ed3eb-ed45-4180-a58e-b68f72edb799/dell_latitude_e7450_price_in_india.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/893f377d-39f2-4648-b3ad-d446493e269c/nordictrack_c_2450_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbcb60e1-7854-47c8-886b-e5ecb0992849/39572042436.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71ae2925-a99a-4598-aad4-5a970a0dc500/7388463847.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3435d460-aee4-418d-90d9-133c97f14d4e/update_s3_bucket_policy_using_cloudformation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c8b2683-16b4-48e8-84a1-40aabfaa4b54/dumevesowez.pdfIn PDF document text
    • http://zuvevetub.pbworks.com/w/file/fetch/144577584/86951057504.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91385366-f973-4a07-873b-569ddbc0b4e0/telugu_dubbed_movies_2020_download_tamilrockers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e00e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE00E 5644 bytes
SHA-256: dffddd9706d11a1337e454616971afc02257cc71dfbdf38dc8768ccdf9fa87f1
font_01_sfnt_off0000f330.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF330 10800 bytes
SHA-256: 35483d94379f1ef86f7e000bccf106fd9678563c5a002402279db475b7d67b4a

Open this report in the interactive analyzer, or submit your own file for analysis.