Malicious PDF — malware analysis report

Static analysis result for SHA-256 38458b58e068075b…

MALICIOUS

PDF

75.2 KB Created: 2021-02-13 21:56:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 037f2de1201cb558f736617ff825b3d7 SHA-1: e46823c79aa44630587d0ede6c1f86370a1b7971 SHA-256: 38458b58e068075b33147dbfb9e588c183e272b31bb5eeb6daff3a05e4903e3d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a URL that is likely used for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a lure related to a product manual, aligning with a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/aws?utm_term=chamberlain+liftmaster+model+1245r+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4471985/normal_60177243b6818.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391001/normal_5fdaf0fb49751.pdfIn PDF document text
    • http://filemarker.store/nautical_almanac_2020lzsdh.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485809/normal_6001924722422.pdfIn PDF document text
    • https://cdn.sqhk.co/niramojiga/7SuDkAG/sesoferono.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380540/normal_601aaa15be585.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486778/normal_5fd19d978bdc4.pdfIn PDF document text
    • https://cdn.sqhk.co/xarozowuzosa/gigjWjf/ponaluzoritamidabevo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453906/normal_60172952184d8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376099/normal_5ff556727fee1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376598/normal_5fdd8dbd998ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387925/normal_5fd69b53b3f1e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453336/normal_5fe52a4d9a800.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404741/normal_5fef19af405fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380695/normal_602438f47ca2c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4502436/normal_5fffb5a6f38b7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489409/normal_5fe155ee5cb4d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379973/normal_5fef6d365b552.pdfIn PDF document text
    • https://cdn.sqhk.co/jugomuzuteb/bNW5Ohi/fesutetowifebewufivo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c685.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC685 5588 bytes
SHA-256: 32a10b4ce9a9caab6c27e331d0e253969b017bc01b3ac63bec137a37ae1286b5
font_01_sfnt_off0000d966.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD966 10140 bytes
SHA-256: 9a84b062a7ea8f9964afc38934b3ca35ab3017932a12935236df91e82e2c1273
font_02_sfnt_off0000fc53.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC53 16088 bytes
SHA-256: 54c892f67831590c69ab92c82b7312351b88eb463502434cc715443974eba8ea
font_03_sfnt_off000110fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110FB 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.