Malicious PDF — malware analysis report

Static analysis result for SHA-256 33c9411978b23b62…

MALICIOUS

PDF

72.0 KB Created: 2021-04-30 18:44:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a7b6aec05a98074b8c9154e5e91ed24 SHA-1: ab2a635d8049933ce42f1afb94e1d156ddf0a4db SHA-256: 33c9411978b23b62808485b35fe475bc8d000276d52a7e8f0f07f6f6af917b9f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to educational worksheets, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=compound+probability+worksheets+7th+grade+pdf PDF link annotation
    • https://cdn.sqhk.co/wiwokosokif/ajdgdGx/penavixagitux.pdfIn PDF document text
    • http://testvvd.xyz/petarokunofekijubiguxerxcy2.pdfIn PDF document text
    • http://shimano-stradic.ru/prefix_and_suffix_worksheets_for_5th_grade4vhy3.pdfIn PDF document text
    • http://freud.icu/how_to_see_trading_volumekulga.pdfIn PDF document text
    • https://cdn.sqhk.co/setupemup/c9O7Ehe/common_proper_abstract_collective_nouns_worksheet.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485705/normal_5fc5eeee3d44e.pdfIn PDF document text
    • http://nosinoski.shop/sofewumezagadelipijugs08g.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417213/normal_60605220f323c.pdfIn PDF document text
    • https://cdn.sqhk.co/gonolesuzam/cphchgy/82485576562.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/517fc71b-e9d6-47d3-bee5-a916d9adffe4/graphic_designer_job_salary_in_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5ca7502-bfa4-493d-a765-99c92c1ee085/69194068783.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7464fd0c-207f-40ca-b413-6d7b5e56c4b7/easy_touch_hemoglobin_test_strips.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df0c90e0-3dc9-44f8-8bc1-7384ddad78c3/33449173170.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea4685b5-cf3c-46df-a96b-3190c1882361/is_there_a_dantes_inferno_movie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fb3a353-0b66-42a2-8c16-06c7b3f697d7/schooling_required_to_be_a_public_relations_manager.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af192274-abb2-40f4-854a-b8d4817b2045/she_stoops_to_conquer_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e97d7bb-31d7-4052-b935-465672228e73/why_is_my_jam_speaker_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3168fb2-4ec2-4f74-902d-79db68a72f2d/29562030520.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b36403fc-0167-468f-87e8-4c7e081e89b6/terry_pratchett_reading_order_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c824f33-9826-4d60-a0bb-92774310bc16/what_you_need_to_do_when_buying_a_second_hand_car.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fff976e0-53cd-46dc-9cd4-f377cb0952fc/82054827911.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d931.bin
b3f3c56e77632148f9eb09a04a76c0c7f9a7457fc1c4952217b1cbff14ee5065		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD931 5840 bytes
font_01_sfnt_off0000ecfa.bin
d2bbe560659c4f3ae4aa1bd519eafd56b8575ceaf355f8cbec19424ba8f4a821		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECFA 11048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.