Malicious PDF — malware analysis report

Static analysis result for SHA-256 3438baf8c79e8aba…

MALICIOUS

PDF

69.8 KB Created: 2021-03-29 20:36:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: 29c2972d3da1ed0d72f506dd857690de SHA-1: 25ac490e1f139854a726171c2ae9cdf998eb6924 SHA-256: 3438baf8c79e8aba585a674feff0aeb3a95f675b91bbbfbc0b9f40d92001a662
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics as malicious, including ML and ClamAV detections, and identified as a phishing lure. The primary malicious indicator is the embedded URL which redirects to a suspicious domain, likely for phishing or malware distribution. No scripts were extracted, but the PDF structure itself facilitated the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=padi+open+water+diver+video+section+4 PDF link annotation
    • https://cdn.sqhk.co/dimasemi/HmGgcii/ball_hole_water.pdfIn PDF document text
    • https://cdn.sqhk.co/letarezetap/glkiijh/37947139217.pdfIn PDF document text
    • https://cdn.sqhk.co/pigajifaw/hdsgfhi/63567006356.pdfIn PDF document text
    • https://cdn.sqhk.co/kunimoxifagi/PRBH3ge/daily_deals_and_coupons_apps.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/50da06ab-8a37-4826-8e02-9fc374dd6ee8/coach_quilted_vest.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4327c0f7-c789-4895-8c32-4044e95f8bfc/league_of_legends_patch_notes_10.25b.pdfIn PDF document text
    • https://s3.amazonaws.com/xakajoziwibi/build_computer_parts_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/mudurixo/39613695685.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e95b6a2-6a04-41af-b8ea-ee9f392a0d68/sipubikopakegukute.pdfIn PDF document text
    • https://s3.amazonaws.com/vutame/cheung_chau_food_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/veraxawewib/4_stages_of_embryonic_development_in_order.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65ce842c-1a7b-43ca-8fa7-9f9e2956b863/supra_lock_box_lost_code.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f88fba8f-9221-41b5-8ef0-13681cc0d1b8/rejasiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aefde914-ca72-4eea-96ab-a2c1c4c7cc49/auto_sketchbook_pro_mod_apk_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/how_do_i_find_the_value_of_my_grandfather_clock.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8caa009a-6385-4076-8c79-c08e61a2ac08/raboponobusep.pdfIn PDF document text
    • https://s3.amazonaws.com/vudivuzakal/how_to_use_ba_ii_plus_calculator.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a96a3700-86be-4512-90d4-33efb7417105/zoom_h4n_pro_digital_multitrack_recorder_price.pdfIn PDF document text
    • https://s3.amazonaws.com/sirilagewuga/como_cerrar_una_cuenta_de_facebook_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c8b4f6b-f88b-495d-a835-14057eaa0355/59252724946.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/41ac2a6f-ad0a-42c5-be43-b4d6144a3324/fuxisamo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d39d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD39D 5276 bytes
SHA-256: 7e3b91a9a340c432066635e21d6f44edd68b1e2210c3e9a4165d9d79bdcc3094
font_01_sfnt_off0000e5bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5BB 10800 bytes
SHA-256: 7495d4ef67e3e37446cb6b25f8276d895f24f16851e43be38ddd5148f1abffbc

Open this report in the interactive analyzer, or submit your own file for analysis.