Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e502839ecdf7459…

MALICIOUS

PDF

96.4 KB Created: 2020-12-03 17:59:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: b35162dbabc7992b1ceeed43089b0b22 SHA-1: b81e618123f12269a4c12228c63e5d12a03ccd4c SHA-256: 4e502839ecdf74593e7dc2d0d33a6516efc197991e8d90f129a0aa3cb96c27e5
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a domain known for distributing malicious content. The document body, though heavily obfuscated, appears to be a lure related to 'caller tunes'. No scripts were extracted, but the presence of an external URI and the ML/AV detections strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=best+caller+tune+in+tamil PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4365627/normal_5fa67dddce7f2.pdfIn PDF document text
    • http:///\/www.paatuvarigal.com\/2017\/04\/enna-nadanthalum-song-lyrics-In PDF document text
    • http:///\/www.lyricsol.com\/alunguren-kulunguren-lyrics-chandi-veeran\/,video_url:,zoomit:0,premium_content:0,is_premium:0,preview_url:null,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:JunIn PDF document text
    • http:///\/tamil-paadal-varigal.blogspot.in\/2008\/09\/arabu-naade-lyrics-thottal-poo-malarum.html,video_url:,zoomit:0,premium_content:0,is_premium:0,preview_url:null,rest_lev:0,rest_msg_free:null,rest_msg_paid:null,_e:0,aes_enabled:1,aet:1,release_date:JanIn PDF document text
    • https:///\/a10.gaanacdn.com\/images\/album\/58\/1808958\/crop_175x175_1596799460_1808958.jpgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc1beaab8467722f1da3b48/t/5fc88bf443b29e7a5af8a039/1606978552367/xewilopixidig.pdfIn PDF document text
    • https://s3.amazonaws.com/memul/36686473205.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76f71388-ba94-47e4-b727-365c05755d19/goliath_national_bank_real.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5c2ac8ef7301f8b3249da/t/5fc65e303485235c86a06490/1606835760907/85835839147.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/google_authenticator_apk_play_store.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4cff5147b148042984a8/1606372607350/wedekuligigitagadiralede.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e5b8a3bf4b14aba92f9c/t/5fc161e3a97599144e2b3e54/1606509027952/wibanuviwimil.pdfIn PDF document text
    • https://s3.amazonaws.com/texifaxepag/chemistry_of_life_worksheet_bohr_models.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86f5e938-289f-45f9-8458-f241f0b2ffa0/94408362872.pdfIn PDF document text
    • https://s3.amazonaws.com/bulikowexunepov/93387076621.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27bbedd3-c9e0-42f0-acd7-5e716aeddc06/79718555148.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf591feaf37e3b6493011e/1606375712368/nagewufezo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc11355ab79f442f22aa123/t/5fc59cb418e72e5fdb98c985/1606786228709/290004135.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013e42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E42 4996 bytes
SHA-256: 2b149db12d11f3482aecd27ebb559e486ba79adc8a7cabb6a7e869f32947d9b8
font_01_sfnt_off00014f27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14F27 11228 bytes
SHA-256: c269470f975ea4aafb3ecbf5d7f98625d0ad9a1c824570ec0edd20b7c85cca2d

Open this report in the interactive analyzer, or submit your own file for analysis.