Malicious PDF — malware analysis report

Static analysis result for SHA-256 496c23d1d1dfd033…

MALICIOUS

PDF

77.9 KB Created: 2021-03-28 15:57:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: fbb9902e3140e7f82ebfeda0da0d52cf SHA-1: 7106df8f94ea7b4d1f708a632165a802b3f19b9d SHA-256: 496c23d1d1dfd03302250d663421895810732c671f462d60ec058323bad0d035
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that leads to a URL disguised as a document about retail credit risk management, indicating a phishing or social engineering lure. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to download a second-stage payload. No scripts were extracted, but the presence of external URIs and the invoice lure heuristic point towards a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=retail+credit+risk+management+pdf PDF link annotation
    • http://1-bog.ru/55668884406y56ii.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401505/normal_60279c4bc2260.pdfIn PDF document text
    • http://tohld.in/what_age_is_twilight_good_foryksuk.pdfIn PDF document text
    • http://gouliwer.online/positive_thinking_activities_for_adultswzape.pdfIn PDF document text
    • http://pochta-24.cc/107020561826hifk.pdfIn PDF document text
    • http://repaircreditscore.info/how_much_oil_does_a_mazda_3_2.5_takesi0is.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479454/normal_5ffcca61c7f4d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380883/normal_603a726d02797.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420230/normal_601f117a1f026.pdfIn PDF document text
    • http://healthytrands.com/huck_finn_quotes_about_friendship_with_jimnn2y7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wuwabobujasivor/how_much_do_sat_subject_tests_matter.pdfIn PDF document text
    • https://s3.amazonaws.com/sojebelevenex/toyota_camry_2007_xle_owners_manual.pdfIn PDF document text
    • https://57933e30-1e86-4cbe-ad2b-777cb72f9932.filesusr.com/ugd/235f1a_af7712d0900a4e7e8065f96cded337cb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rimepusox/disable_secure_boot_android.pdfIn PDF document text
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_f52e49bcb5c544529413b3f965a49383.pdf?index=trueIn PDF document text
    • http://fujafinu.epizy.com/daffynition_decoder_answers_f12.pdfIn PDF document text
    • https://s3.amazonaws.com/musokejixami/ambili_ammava_malayalam_song.pdfIn PDF document text
    • https://0c2a99dd-71fd-4a0d-b96f-672cfa785c21.filesusr.com/ugd/515c54_e228bf88bf0c458aa346bd072b5c371d.pdf?index=trueIn PDF document text
    • http://dadizapapegase.rf.gd/87987457692.pdfIn PDF document text
    • https://436c154b-1c2d-4c60-9768-ed3a268ef5e1.filesusr.com/ugd/e8e253_e91de06cd32b459e8f40720119b9f094.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/magapeguwabe/australian_flag_emoji_android.pdfIn PDF document text
    • http://muvabeso.epizy.com/what_einstein_told_his_cook_kitchen_science_explained.pdfIn PDF document text
    • https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_cf0c8d7a2f49456080b7b140e464417b.pdf?index=trueIn PDF document text
    • http://nawezupuzevise.epizy.com/89945742500.pdfIn PDF document text
    • http://lunodemexixape.epizy.com/pezaliluvozaj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f461.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF461 5544 bytes
SHA-256: 24445e6e75f4c65818c5bffb58f5438c6b783b5a917e352fff72791b37613db9
font_01_sfnt_off0001072c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1072C 10188 bytes
SHA-256: 6a63c4076f8ffd8929d26dd4ba117bbcf0daa3cef450240ed538578885bc7dff

Open this report in the interactive analyzer, or submit your own file for analysis.