Malicious PDF — malware analysis report

Static analysis result for SHA-256 64357c49f480f8eb…

MALICIOUS

PDF

235.1 KB Created: 2021-03-22 05:33:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 551c7ad1792016cdad07247130a03f92 SHA-1: b0c44c7311837c67c8211af05a82677fc840c5bd SHA-256: 64357c49f480f8ebeb63e77aedf35744aded865f0fcdc40628a73c1942604a62
164 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a machine learning classifier and ClamAV, indicating a phishing or trojan threat. The document body and heuristics suggest a lure related to Amazon and YouTube notifications, directing the user to a suspicious URL. This URL likely serves as a landing page for credential harvesting or to deliver a secondary malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9774

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://xajibur.ru/wix?keyword=noreply+youtube+com+%25E3%2582%25A2%25E3%2583%259E%25E3%2582%25BE%25E3%2583%25B3.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/wix?keyword=noreply+youtube+com+%25E3%2582%25A2%25E3%2583%259E%25E3%2582%25BE%25E3%2583%25B3 PDF link annotation
    • http://wugipesirexoxof.mygamesonline.org/alpinion_e_cube_5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496153/normal_6039669d1775a.pdfIn PDF document text
    • http://kodepovorivapi.mygamesonline.org/oracle_12c_sql_chapter_5_hands_on_assignments_answers.pdfIn PDF document text
    • http://desokore.medianewsonline.com/panasonic_viera_smart_tv_touchpad_remote_control.pdfIn PDF document text
    • http://xufikefizot.sportsontheweb.net/zulekolewuvepanonot.pdfIn PDF document text
    • http://lipexifinidoda.scienceontheweb.net/bad_boy_story_name_ideas.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409619/normal_602a25cf96cf6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379362/normal_602232059eb3a.pdfIn PDF document text
    • http://fakixigulidol.mywebcommunity.org/descargar_death_note_castellano_netflix.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450511/normal_6050779cea14e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/6dd62497-67e0-45eb-8150-0daab8183132/florida_highway_safety_and_motor_vehicles_reported_of_traffic_fatalities_are_alcohol_related_in_2009.pdfIn PDF document text
    • https://s3.amazonaws.com/bubeto/best_light_novels_to_read.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4aa98d42-0467-409d-be69-e1a2a932eeae/vadagegakepuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7518a430-5e00-495b-ade4-566e08a0238b/how_to_set_a_motion_sensor_flood_light.pdfIn PDF document text
    • http://satonavuka.rf.gd/24_7_capitalismo_tardio.pdfIn PDF document text
    • https://s3.amazonaws.com/jikopot/fodivusozawosalawe.pdfIn PDF document text
    • http://patuwovoparivi.rf.gd/nixubifinenovazu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74211fdc-dd64-40e7-b16d-dd6159ca9412/hp_laserjet_1012_driver_mac_catalina.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0711eac4-c640-4b3b-a6d9-ace30ab55dae/breadman_plus_jam_recipes.pdfIn PDF document text
    • http://mewexam.epizy.com/sizutifozatevigo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000152ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x152ED 162204 bytes
SHA-256: 8bfd1ed6cf40025451e29717d43621c6ab4886d3ac9ab0060fefda9c133373f4
font_01_sfnt_off00032d13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32D13 3540 bytes
SHA-256: 4cd7df47f01d27edefca3337ba63fecae9ff19d3a106e8f7476943935d1ed75f
font_02_sfnt_off000339aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x339AA 4632 bytes
SHA-256: 56a65288107bce5ab98349ff28e6b9a1362be3a7c95ea896311a3583c6013879
font_03_sfnt_off0003497d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3497D 13728 bytes
SHA-256: e410b8dd4bea447566d5882f7d448648806130b67ccfa0557317340acb4f0b72
font_04_sfnt_off000375e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x375E7 16500 bytes
SHA-256: b6796a74802fe13050fe4d360a358a4f802784f0ea50b73d3465ff2d5ff6cf2b
font_05_sfnt_off00038c55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38C55 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.