Malicious PDF — malware analysis report

Static analysis result for SHA-256 39b5ea2eb9a2396a…

MALICIOUS

PDF

78.8 KB Created: 2021-03-28 14:23:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: dbcb274aedb459e3f268af3610250cc3 SHA-1: c5b5b03835d03275884e08aa3942acef5a92edd8 SHA-256: 39b5ea2eb9a2396a6ae8f372787afe969e928456abe72713ebd144c9508989c8
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, specifically using a "PDF compressor" theme to entice users. It redirects to the URL https://fokemale.ru/award?keyword=pdf+compressor+mac+os+x, which is flagged as a high-risk indicator. While no scripts were directly extracted, the ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=pdf+compressor+mac+os+x PDF link annotation
    • http://nekutijefaxikar.iblogger.org/baofeng_uv-5ra_range.pdfIn PDF document text
    • https://cdn.sqhk.co/wedegetuso/jjAN9Rc/strikemaster_40v_8_vs_10.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416675/normal_6037cb7070d9f.pdfIn PDF document text
    • http://suxusojifuf.iblogger.org/questions_to_ask_in_christian_premarital_counseling.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381091/normal_5fd8372fb9bc3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450438/normal_5fd9abb2b1718.pdfIn PDF document text
    • https://cdn.sqhk.co/kawurefeki/Ziahjxu/stick_fight_2_mod_apk_android_1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366375/normal_604e7997565a3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_ab1fcaea1940425a98a05c92eba51216.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mozedijiz/68314117778.pdfIn PDF document text
    • https://s3.amazonaws.com/sorapobuk/adobe_photoshop_creative_cloud_free.pdfIn PDF document text
    • http://vakakumiwizexoj.epizy.com/31673747216.pdfIn PDF document text
    • http://jeburam.epizy.com/busoba.pdfIn PDF document text
    • https://9aef9be9-4304-4ec6-b02b-ded1eabc5d1b.filesusr.com/ugd/a571b8_05aa5d0f379741f48d31d2c9150861c8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gateme/what_is_gnostic_mean.pdfIn PDF document text
    • https://4c2674ec-1430-4cec-a455-d6a35d10586e.filesusr.com/ugd/38955b_9e627e0a32d14aae9fb10af3ee30ebfe.pdf?index=trueIn PDF document text
    • https://b3709dad-42f4-4621-9b7e-74d31ca978cd.filesusr.com/ugd/f91cf1_3b3bdbabc7794b50b51656ccf0922d73.pdf?index=trueIn PDF document text
    • https://9764c975-acb6-4bd5-a3ff-b1f4624bc9bc.filesusr.com/ugd/5bcb7b_16a97c4550f5401aa69479fca090425c.pdf?index=trueIn PDF document text
    • http://kufimaxez.epizy.com/10000320824.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/connect_universal_remote_to_roku_stick.pdfIn PDF document text
    • https://9042e326-c85f-44e6-b9b6-0c206471fdba.filesusr.com/ugd/0d2fda_880567dd64214b22a9107c9bdab4c206.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fulazelof/jerat.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4DC 5336 bytes
SHA-256: 4964d0359635a4f999c8374fdd9606bcc6addec491acc0ec612f0f830ade9910
font_01_sfnt_off000106f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106F6 11276 bytes
SHA-256: 924fb819c797c6a614dec6501f725ccc1abf5964beff23d1cf9102c1c5330651

Open this report in the interactive analyzer, or submit your own file for analysis.