Malicious PDF — malware analysis report

Static analysis result for SHA-256 55bf75bd7ac1603a…

MALICIOUS

PDF

72.4 KB Created: 2021-05-30 06:43:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9922fea6d2f22e88d3042f4ed1e3389e SHA-1: c6f5995973755ad4d740756f94f3b8d0c031cf5c SHA-256: 55bf75bd7ac1603a09385e93bb641f7911220eef4560eae6dbd6f44cffdd45d5
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, which is likely the primary payload delivery mechanism. Although the document body is heavily obfuscated, the presence of the malicious URL and the strong detection signals indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=cuaderno+preescolar+3+pdf+2020 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4530429/normal_5fd6487883f77.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453885/normal_601e12858ea7c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367308/normal_6047559cc7905.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372373/normal_5ffe7e6b534e6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486199/normal_601b35c340945.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408995/normal_5fddaec1c7fc1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445341/normal_5fd3168b580f6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365580/normal_6021d0c49ce9c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422134/normal_601078b936c62.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366043/normal_6028ccaf06d1d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385417/normal_600ae88037de5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366335/normal_606297ab15fac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379034/normal_601cf72559f09.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377403/normal_6012d660cab37.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471240/normal_5fcaedfeb886b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/77be4d11-e445-4a5a-a5b8-c9e28fcc8409/wodepinikaxokejakozevu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31954263-e0cb-463d-b807-9f1ba7655f31/21744521147.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f507c3ef-e35b-492c-8172-2aa2912b76cb/how_to_get_your_crossfit_level_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd4efd30-3dea-44ee-bf20-6c1bb104c2b8/mofugajajiwe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/081c1ccd-c4b7-4c5d-9ece-9f8c614f6942/97375605077.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f53eacda-94c1-4714-8bc8-dbdc62b904fb/fafinovuwewi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/299ff14c-2035-4f39-8f7e-7d9f7d2ea0d0/what_is_the_smallest_gps_tracker.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf05cf2b-8359-4ffc-8466-98556400e212/how_to_program_spectrum_remote_rc122_to_vizio_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20b37af7-95f0-42b3-9d7a-cf3f095848ac/how_to_put_a_vinyl_sticker_on_wood.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA78 5492 bytes
SHA-256: 671928bfaace5f69daf1f6d0092a590aaafbf43e38039f090da979a745fbbb0b
font_01_sfnt_off0000ed33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED33 11368 bytes
SHA-256: d6499340c0e821c732e4fa4d7b30c51195775e40087be7978dd87761587852b1

Open this report in the interactive analyzer, or submit your own file for analysis.