Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e2dd04833882977…

MALICIOUS

PDF

78.8 KB Created: 2021-03-27 20:05:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: a64f814e0c16226c51e1688ea703bded SHA-1: 082cfa560d9ecd4244a9fcfd12940621b1601d68 SHA-256: 4e2dd04833882977bcc0919e5c5748b537dd098a1cb9236d09ff173e60050ec2
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI and a heuristic firing indicating an SEO redirector link, which points to 'https://dugedepap.ru/123?utm_term=call+recording+app++2018+free'. This URL is presented as a lure for a 'call recording app 2018 free', suggesting a phishing attempt to trick users into downloading malware or visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=call+recording+app++2018+free PDF link annotation
    • http://creditscorefix.info/past_tense_in_englishs4u9a.pdfIn PDF document text
    • http://begemotiks.fun/67106885164m9dby.pdfIn PDF document text
    • http://ukrinsure.com/mewuzesexusimodotumetuvskxn.pdfIn PDF document text
    • http://goodsun.space/billboard_music_awards_bts_performanceafokd.pdfIn PDF document text
    • http://verifiedbadge-lnstagram.com/tv_shows_quiz_questions_and_answers_2019v5qlj.pdfIn PDF document text
    • https://cdn.sqhk.co/wujakegu/ejjF3FG/ps4_flying_games_vr.pdfIn PDF document text
    • https://cdn.sqhk.co/nobipajami/igrAFji/fashion_photography_story_ideas.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_3d2fbe0328d34079aec98e561467851a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb7b672c-75fc-4c3a-b8af-c9dd3fa5adee/virisiw.pdfIn PDF document text
    • https://s3.amazonaws.com/memexelu/simple_timeline_of_us_history.pdfIn PDF document text
    • http://tisudaxutuz.epizy.com/calcination_process.pdfIn PDF document text
    • https://s3.amazonaws.com/fibesezati/tao_te_ching_what_is_it.pdfIn PDF document text
    • http://jefeduwikiw.epizy.com/symmetry_worksheets_ks1.pdfIn PDF document text
    • https://1138278f-e8d0-45ef-aef3-dbdd7428ac52.filesusr.com/ugd/5be868_9e65d0a688af49649118f20332109746.pdf?index=trueIn PDF document text
    • https://9d50af6f-dbf7-41ba-b854-83985329a12b.filesusr.com/ugd/33c377_ecce8835a93d40a8b380d098b6be245c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb67be3e-af0d-4ec0-9dc1-6f605ebfb168/91461992707.pdfIn PDF document text
    • http://diginerovitigu.rf.gd/editing_file_on_iphone.pdfIn PDF document text
    • https://s3.amazonaws.com/kujapomib/69066274204.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28e7acf2-b054-41ca-b591-70a9ae55c046/what_is_project_zorgo_name.pdfIn PDF document text
    • http://xepepofebaxuvib.epizy.com/guidelines_for_esophageal_varices.pdfIn PDF document text
    • https://s3.amazonaws.com/dusined/libreoffice_calc_vlookup_another_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/how_much_does_it_cost_to_start_a_climbing_gym.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F2 5568 bytes
SHA-256: f0701694b309fbdcc2486bc2caca92cee83c2f181fe2d4f3d329d06e5df0befb
font_01_sfnt_off00010af6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AF6 10312 bytes
SHA-256: 294f024c6c51c56fe1e547c9e36fe945f952fa8631079654b081962699d6d8e8

Open this report in the interactive analyzer, or submit your own file for analysis.