Malicious PDF — malware analysis report

Static analysis result for SHA-256 389fda67d82eaa26…

MALICIOUS

PDF

156.2 KB Created: 2021-03-09 21:57:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 73b9f6fa74d12d63f30d51693948f4f2 SHA-1: b80c313d1393af4617c9a06d5d2711a05d290689 SHA-256: 389fda67d82eaa26dd1b4d8c9eb8f7fa92a492250717996ce4f67bcc677161f1
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, specifically for brand-impersonation credential phishing. The document attempts to impersonate Apple, directing users to a malicious URL that hosts a PDF. While no scripts were extracted, the presence of external URIs and the phishing lure strongly suggest an intent to trick users into providing sensitive information. The file's structure and embedded content are consistent with a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://melesanej.weebly.com/uploads/1/3/1/1/131163783/zelukij.pdf.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=suica+card+japan+android PDF link annotation
    • http://vukabuv.22web.org/nosivakigabulojawesag.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368984/normal_602839272a226.pdfIn PDF document text
    • https://melesanej.weebly.com/uploads/1/3/1/1/131163783/zelukij.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482230/normal_5fff74138186a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384050/normal_5ff008b958260.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410703/normal_603201eb899c4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471109/normal_601b7fa317035.pdfIn PDF document text
    • https://dasezakam.weebly.com/uploads/1/3/4/8/134883145/wumafalu.pdfIn PDF document text
    • https://kanefudejezem.weebly.com/uploads/1/3/6/0/136056225/mumubidizajosakilo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xovekolamoxe/one_page_1_to_500_numbers_chart.pdfIn PDF document text
    • https://s3.amazonaws.com/kuxuxemu/17984577276.pdfIn PDF document text
    • https://s3.amazonaws.com/mejados/2005_kawasaki_brute_force_750_performance_parts.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/bamboo_cotton_sheets_1000_thread_count.pdfIn PDF document text
    • http://jilagikudi.rf.gd/micro_usb_barcode_scanner_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c7073fe-bb00-488d-881b-c37a4ab889cf/jedibo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0960108a-b491-4820-8e82-c73b930e49d8/72960844166.pdfIn PDF document text
    • https://s3.amazonaws.com/lizuseguwix/1689534623.pdfIn PDF document text
    • https://s3.amazonaws.com/woxojuxafopuv/tuvidi.pdfIn PDF document text
    • http://pubexet.rf.gd/bereken_bmi_formule.pdfIn PDF document text
    • http://xezipunefosipu.epizy.com/barebi.pdfIn PDF document text
    • https://s3.amazonaws.com/zuniverijesud/12132498706.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/715c4fae-9e11-4a0d-9fd4-2176f2900fc1/6690773418.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d276.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D276 26552 bytes
SHA-256: 01fe2815c1efe69acad37f14dd059d723933aed73033cacf53d1ff03b4ad73c2
font_01_sfnt_off0002262d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2262D 5036 bytes
SHA-256: 3ce913bd0e21596979fe056fb7873599ebf8feb1a7d86140c7cb39aee24f15db
font_02_sfnt_off00023762.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23762 13184 bytes
SHA-256: a51872bcaa2159292327030153c746b38cbca464be2cc10221288dbee7405bbc

Open this report in the interactive analyzer, or submit your own file for analysis.