Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b1b3501ebfda05e…

MALICIOUS

PDF

1.78 MB Created: 2021-05-29 06:09:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 036f768aaa4afc109a816a9f3793320c SHA-1: c9e9c02edffc270a4259e663283a78dabb405da8 SHA-256: 2b1b3501ebfda05ef9f42dd5d727ff7200fa6538442d050f885576cbdf170ad7
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV with a signature indicating it is a phishing trojan. It contains an embedded URL that uses a popular game's name in its query parameters, suggesting a lure to attract users. While no scripts were extracted, the presence of embedded URLs and the ClamAV detection strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0056

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=cyberpunk+2077+johnny+silverhand+relationship+percentage PDF link annotation
    • https://siputewebototab.weebly.com/uploads/1/3/4/4/134480832/jusogeru.pdfIn PDF document text
    • https://sakixuso.weebly.com/uploads/1/3/4/4/134488330/wakorekov.pdfIn PDF document text
    • https://kumigovujubexug.weebly.com/uploads/1/3/0/7/130776874/94fac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456984/normal_600e072a9b218.pdfIn PDF document text
    • https://wupibivuvofat.weebly.com/uploads/1/3/1/1/131164023/a4b90.pdfIn PDF document text
    • https://laxonetamaj.weebly.com/uploads/1/3/4/0/134096763/64a335.pdfIn PDF document text
    • https://gipebikurowa.weebly.com/uploads/1/3/4/0/134095939/nuxiro.pdfIn PDF document text
    • https://rupanusevufow.weebly.com/uploads/1/3/1/3/131380126/9b0a955035.pdfIn PDF document text
    • https://falopizesolirod.weebly.com/uploads/1/3/1/3/131379111/7f2dc393f5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459320/normal_6047f413f2e6c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/35f118f7-1355-4d0e-8f54-2ea731a8c24d/73605352780.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11c5ab47-758e-4cf9-8662-ea84c1a18f25/58118993571.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0f03278-67a4-44f1-9d29-15eb71cce5ff/what_does_a_program_management_office_do.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a6bd1fe-1001-4d50-b2c3-81f47c9fbd0a/cognitive_approach_psychology_definition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91fc72fc-534e-447a-9bfa-2ec7210c2071/80104842451.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb01c56c-e0e3-4741-9429-f4a7eec599ae/may_god_always_guide_your_path.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea455c1e-369c-4db6-9b30-b9be86fb7ce1/50cc_70cc_90cc_110cc_125cc_chinese_atv_service_repair_manuals.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5c7fe50-b74d-4dfb-8802-f8195938e55f/11031186582.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82ebdfac-2dae-42e8-844b-05351675413d/feragelovupugukukamusavo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d92f675-401b-4e82-a38a-36ebdbe5df37/17032281790.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf7b7eb7-f155-4871-9d60-5311184a2978/6138563650.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f169ad6c-7027-4c20-ad13-19829dd89769/36591818290.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off001c07f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C07F0 6036 bytes
SHA-256: 120bebd2c518b54949ee2cdf83c1147a207acd959bc7a4e3e8169de37ce6da33
font_01_sfnt_off001c1c94.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C1C94 16248 bytes
SHA-256: 94bd79fcbaa077c07cd00dbedff3dd24587063568c7a23f4931182bb888bb851
font_02_sfnt_off001c4f59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C4F59 16476 bytes
SHA-256: ae6776c7a933e3da9a817cdd4d2787550c10cfd793f594f8acf0d9f92280711d

Open this report in the interactive analyzer, or submit your own file for analysis.