Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e16deb0d40cb362…

MALICIOUS

PDF

92.0 KB Created: 2021-05-18 08:37:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a3cb7d7191cc3674c8b003b990ac8d7a SHA-1: 30a0c73d4e265fb9e99b154c5a053a05b3eb28d0 SHA-256: 4e16deb0d40cb3627001a059d138d856c88df9c7b11e5d826f7355547375b6b2
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic indicating a mass external link farm, with one prominent URL suggesting a lure for downloading an Android app. ClamAV detection and ML classification strongly indicate maliciousness, specifically flagging it as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=descargar+ultima+version+de+android+para+tablet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4464542/normal_606884b3b40d1.pdfIn PDF document text
    • https://sulabejo.weebly.com/uploads/1/3/4/6/134689147/dawitezibefuki.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407316/normal_5fdc7e1332758.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445877/normal_60433a42a69e5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425227/normal_5fce6e1620f8d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412165/normal_606c797466ec5.pdfIn PDF document text
    • https://rarejiwu.weebly.com/uploads/1/3/1/6/131606055/8084059.pdfIn PDF document text
    • http://pusikoxelumide.iblogger.org/tenulasibupox.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/senodiw/sentence_fragments_practice_exercise_1_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/tigewibejageju/wordpress_add_blank_page_template.pdfIn PDF document text
    • https://s3.amazonaws.com/kewuxejikiwe/how_do_you_use_lateral_thinking.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0057df9-d244-4e5a-9daf-6d860f3235b2/juegos_entre_hombres_y_mujeres.pdfIn PDF document text
    • https://s3.amazonaws.com/goveruduzewoxu/lazodepukogogitezeputas.pdfIn PDF document text
    • https://s3.amazonaws.com/towutoginadivu/canon_ip2700_printer_user_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d7f03ca-af87-414f-bd8c-85e5e456c01f/what_state_has_the_highest_average_income.pdfIn PDF document text
    • https://s3.amazonaws.com/sazomo/socio_cultural_environment_meaning_in_hindi.pdfIn PDF document text
    • https://s3.amazonaws.com/nafamaragisek/online_grammar_practice_for_middle_school.pdfIn PDF document text
    • https://s3.amazonaws.com/loneminovu/roman_numerals_worksheet_5th_grade.pdfIn PDF document text
    • https://s3.amazonaws.com/gezetega/du_battery_saver_software.pdfIn PDF document text
    • http://xawosote.epizy.com/javeruregawabunijasuruf.pdfIn PDF document text
    • http://xamawesurasido.epizy.com/84960209399.pdfIn PDF document text
    • https://s3.amazonaws.com/robumuduluwise/63033780795.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/306dfd97-42e2-46b6-8463-3527a0768c72/stihl_battery_weed_eater_price.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001270d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1270D 5592 bytes
SHA-256: 05a5a2f8ccf0228be3d94e45e5d9f93dcb391f71e0ef0b84081ba600db075b5e
font_01_sfnt_off00013a04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13A04 11760 bytes
SHA-256: eba5e614b21f661d50483ba6ae3f75b17caf6cccf8fe6fa413289d14b38d7d74

Open this report in the interactive analyzer, or submit your own file for analysis.