Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b1eab6d08220ff4…

MALICIOUS

PDF

106.4 KB Created: 2021-04-05 17:08:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: 615d7545b3580249519d8f620acba441 SHA-1: d40efa14fd2b205def3e452a9a8bf5b86acfe0b5 SHA-256: 3b1eab6d08220ff4d0a09e9c46a4c8593c2d048b929e07fe73a7b5003bc3501d
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a high-confidence ML detection and a ClamAV signature indicating it is a phishing trojan. The heuristic 'PDF_SEO_UTM_REDIRECTOR_LINK' specifically points to a phishing lure using an SEO redirector, with the primary IOC being the URL 'https://midufefew.ru/award?keyword=cancer+gastrico+en+el+peru+pdf'. While no scripts were explicitly extracted, the PDF structure and the nature of the detected threat suggest potential for embedded JavaScript or other exploit mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=cancer+gastrico+en+el+peru+pdf PDF link annotation
    • https://cdn.sqhk.co/nolovojawek/ggiEIje/anime_arcade_near_me.pdfIn PDF document text
    • https://cdn.sqhk.co/sobupepokor/hed6hgu/27947321990.pdfIn PDF document text
    • https://cdn.sqhk.co/kusamika/bjhifji/clash_of_clans_hacked_server.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c25c9787-fa80-4ca2-b34a-688de3f492cc/nikon_coolpix_s9600_price_in_india.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b69689e-cfa4-4947-8d66-e3ab9a5aef47/36928037704.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c07cd2d5-5f9a-4005-9b11-0535b296facb/20168702358.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3291e3f2-0059-4b58-89de-c6d6fd86dc81/vitamix_blender_troubleshooting_repair.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0f30df7-f5b6-4898-a0ed-21c82af1d3bf/tavalefiluwosefumibu.pdfIn PDF document text
    • https://s3.amazonaws.com/pegozegi/freeze_cells_in_google_sheets.pdfIn PDF document text
    • https://s3.amazonaws.com/xirixepo/54983528370.pdfIn PDF document text
    • https://s3.amazonaws.com/vuzotisenixava/ccleaner_pro_apk_windows_7.pdfIn PDF document text
    • https://s3.amazonaws.com/sudevejerifu/how_do_scales_measure_bone_mass.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09139c13-eb9a-4cee-b0d3-22a4967bcf9b/zitotaduti.pdfIn PDF document text
    • https://s3.amazonaws.com/boxalewijim/72564835269.pdfIn PDF document text
    • https://s3.amazonaws.com/piwanisaj/85498744124.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e335ad91-2685-4f58-9119-d09f37a3c5f9/22811711798.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fda0d551-4217-4da3-9338-2adb5e7429b6/seagate_goflex_home_forgot_password.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/rawagimeti.pdfIn PDF document text
    • https://s3.amazonaws.com/neporezofov/vegurifibusuru.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014da4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14DA4 5228 bytes
SHA-256: 3f1fdf62866d81dbefd6f9fee9b862e6b0745d27da76e4b18eeadb0547d44474
font_01_sfnt_off00015f7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F7B 11172 bytes
SHA-256: 5da433d4d12ae32cb4e40d5645c860d09733db29fa03e1b1e2cd61684c5a4e07
font_02_sfnt_off00018548.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18548 16204 bytes
SHA-256: 532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e

Open this report in the interactive analyzer, or submit your own file for analysis.