Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b7f431344f3b57e…

MALICIOUS

PDF

83.6 KB Created: 2021-03-18 20:04:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 4d3b370cb6a4d6d2116321f9af74b361 SHA-1: b86b29c4a22064d464a36fc19edc1752d720abff SHA-256: 4b7f431344f3b57e20a76d9cff7ea5a70e9df34bce68ba1c525c279a4050c6a3
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate the presence of an external URI and an SEO redirector link, likely used as a lure to direct users to a phishing site. The document body, though truncated and obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=kevlar+aramid+fiber+pdf PDF link annotation
    • https://cdn.sqhk.co/tefazaturar/j2brLlu/76769377826.pdfIn PDF document text
    • http://zupedaganivo.66ghz.com/zesumodugupikegisaxowi.pdfIn PDF document text
    • https://cdn.sqhk.co/pumibavi/64XiRsq/7_days_to_die_hammer_vs_nail_gun.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500665/normal_60373b7cbe244.pdfIn PDF document text
    • https://cdn.sqhk.co/sovajepuxe/i0Q3dra/nunalekokusuvepidawilinib.pdfIn PDF document text
    • http://sesapoleva.22web.org/example_of_a_school_psychological_report.pdfIn PDF document text
    • http://nejamaranidirit.22web.org/gumobexamobeloxoxor.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478387/normal_60517adee87bf.pdfIn PDF document text
    • https://cdn.sqhk.co/vapumojemov/2jfhjPn/zadawazomizeporalefowilu.pdfIn PDF document text
    • http://poguferuliwu.iblogger.org/87159691349.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tanasebebibe.epizy.com/23810039176.pdfIn PDF document text
    • https://s3.amazonaws.com/wipotegadodorek/does_keurig_elite_use_k_cups.pdfIn PDF document text
    • https://s3.amazonaws.com/zonebon/33216485661.pdfIn PDF document text
    • http://mikesivu.rf.gd/zibakaxufun.pdfIn PDF document text
    • https://s3.amazonaws.com/wovugi/bestwap._in_movie_2007.pdfIn PDF document text
    • https://s3.amazonaws.com/mukutud/fax_cover_letter_template_printable.pdfIn PDF document text
    • https://s3.amazonaws.com/tirimofufemukat/tv_line_guide_apk.pdfIn PDF document text
    • http://juxugalipexobow.epizy.com/niwobagaxoxivepolovotuf.pdfIn PDF document text
    • https://s3.amazonaws.com/povodijirig/how_to_fix_a_leaky_delta_shower_faucet_single_handle.pdfIn PDF document text
    • https://s3.amazonaws.com/gazivemon/risimunitegopani.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106FF 5176 bytes
SHA-256: de8afa40a7be7b4fa18e3e873ae57b93999b97d5056cd98e4346c2a5fb5115c2
font_01_sfnt_off0001188b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1188B 11884 bytes
SHA-256: e521e36fa196e5bbb971172db2d40ebb3b2241450972f5361a1b5f108bbd6b7f

Open this report in the interactive analyzer, or submit your own file for analysis.