Malicious PDF — malware analysis report

Static analysis result for SHA-256 42d21e463803dcf1…

MALICIOUS

PDF

77.5 KB Created: 2021-03-02 15:53:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: c26c05bdbd3030c8707c05659cc440ad SHA-1: 09c898bf06ebecd35d90be0e4e99463941f57394 SHA-256: 42d21e463803dcf1b10cd50fe8476ac4e5767113faac43e0dff154c3d02e9242
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier assigned a high probability of maliciousness. An external URI pointing to 'fokemale.ru' was extracted, which is likely the phishing destination. No scripts were extracted, but the presence of embedded URLs and the overall detection suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=do+power+exercises+build+muscle PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4372963/normal_6025c509b1aee.pdfIn PDF document text
    • http://sawemawe.mywebcommunity.org/42205796028.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369182/normal_5ff926e854086.pdfIn PDF document text
    • http://rowowevu.mypressonline.com/zuwaketiji.pdfIn PDF document text
    • http://duzusedolatepe.mypressonline.com/the_book_thief_audiobook_free_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470526/normal_5ff1916ee3ae3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500692/normal_6012639d263a1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://refusunono.onlinewebshop.net/kaxedikaxurisunug.pdfIn PDF document text
    • http://satoposip.epizy.com/lofitaze.pdfIn PDF document text
    • https://s3.amazonaws.com/pazerogasarinu/kookaburra_hockey_shoes_size_guide.pdfIn PDF document text
    • http://fumidafowinub.epizy.com/gimomefatabetiwan.pdfIn PDF document text
    • https://s3.amazonaws.com/lomogas/after_effects_cinematic_title_templates_free.pdfIn PDF document text
    • http://faxiruvud.myartsonline.com/what_does_the_power_of_christ_compels_you.pdfIn PDF document text
    • https://s3.amazonaws.com/fewifuwu/54383415816.pdfIn PDF document text
    • http://pazoluno.epizy.com/mojiwaworubujurixagefatom.pdfIn PDF document text
    • http://gototura.myartsonline.com/70303282732.pdfIn PDF document text
    • https://s3.amazonaws.com/zerepuzuze/sobeb.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f342.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF342 5308 bytes
SHA-256: fbdeb48e45d08619edf01392d69b21ed857169026fecf43abf3f07c300249fee
font_01_sfnt_off00010550.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10550 10324 bytes
SHA-256: 8bdedfaf56b6b619d4ad7bff89399c49cf403914af37fb3d71a8106eaec12a0c

Open this report in the interactive analyzer, or submit your own file for analysis.