Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e721114f7fda450…

MALICIOUS

PDF

81.6 KB Created: 2021-03-14 22:04:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5352970acf4486593cb5477e9e07acba SHA-1: 7286825428e0e5bc9c4fe3f0c80682989e604631 SHA-256: 4e721114f7fda4502754417a00cd4954f9189d729c72ec209484c9933d075ba6
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a malicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, suggests a lure related to a book title, likely to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=aestheticism+in+the+picture+of+dorian+gray+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368732/normal_60426f6a0e5b2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402940/normal_6036be70ab1ec.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368736/normal_5fedea630ac74.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b87eb58a-4ad2-4fea-8880-24687181bed5/perfil_de_egreso_conalep_alimentos_y_bebidas_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b156a7d4-f1eb-4ccf-ba16-267ec1a46289/how_do_i_love_thee_poem_analysis.pdfIn PDF document text
    • https://s3.amazonaws.com/fotepopunaj/shaco_jungle_guide_s9.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52ef566e-152a-4312-bc91-7480d0ea7548/how_to_create_a_form_in_excel.pdfIn PDF document text
    • http://detasagupubat.epizy.com/biofilm_formation_steps.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59484f4c-dbdf-4511-b5c4-7d82fb05f77f/94303665582.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f32cbad-ba5b-40c0-9607-e0bd731a5247/meperuriko.pdfIn PDF document text
    • https://s3.amazonaws.com/buganabowumujef/denidud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f97fb532-64bb-41c0-b51c-6679d545fff5/zaribufetuxorobidovowes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/209bdd93-e95f-4141-8387-36e93f029d13/english_to_urdu_dictionary_for_iphone_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/badodemebo/45545517154.pdfIn PDF document text
    • http://fisuzes.epizy.com/sipasi.pdfIn PDF document text
    • http://jilawovo.epizy.com/chsaa_bylaws_test_answers.pdfIn PDF document text
    • http://tuwidapaj.epizy.com/ejemplos_de_monografias_ib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/29f2876f-78ed-4b36-94f0-606fe0c88cb9/how_to_operate_nikon_d5600.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010182.bin
7e56a80e1314144adeeebb45ee29a7dc2e44bd44249c11f4d659bdc603512b08		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10182 5628 bytes
font_01_sfnt_off0001148b.bin
ee8571f3c3487c0c660c6cf79ba0956edd788a97db995ca20dcb1cd49054c881		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1148B 11740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.