Malicious PDF — malware analysis report

Static analysis result for SHA-256 68154b8c99735848…

MALICIOUS

PDF

76.0 KB Created: 2021-06-07 19:20:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 507455435412f06963d967cba21d0fd0 SHA-1: 95073d6b72f01b0b25f4dc5de3b877186f6c79c9 SHA-256: 68154b8c997358487ec42a226bf8cf73c0ab9f939f79f54ce7887c5cf68ab00a
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a high-severity heuristic indicating it's a lure for free downloads, linking to an external redirector. The embedded URL and the document body, despite being heavily obfuscated, suggest a phishing or malware download attempt disguised as a file manager. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/pbw?utm_term=gestor+de+archivos+samsung+apk PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4419828/normal_6055035269258.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390081/normal_606176f9c67d3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nodisakajew.pbworks.com/f/21743421020.pdfIn PDF document text
    • http://vikiruji.pbworks.com/f/nogofajuropupijeruresutip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ea5f324-04ae-4a15-b2d6-3937d310d2d7/71409354869.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cdea0b24-ef39-43e9-894a-212ceeb85a80/lista_completa_de_comandos_ms-dos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf55c5ce-8e1b-4b5f-90f0-099ac4794359/speed_queen_washer_dryer_combo_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c0c0afa-d630-4c73-b5cb-e312f60b815e/the_holy_quran_english_translation_of_the_meanings_and_commentary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fcb74b31-bcb5-4d85-9ba2-fe6f598aeec9/can_you_use_native_instruments_maschine_without_hardware.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7919f4a7-09f7-4624-88a8-d1ab7b749cc4/how_to_pass_pregnancy_glucose_test.pdfIn PDF document text
    • http://wezenibafasi.pbworks.com/f/how_to_use_cheats_in_gta_san_andreas_ios.pdfIn PDF document text
    • http://pejuzor.pbworks.com/f/kevexigifome.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c509857f-a4e7-43c1-8fb3-4f33b362d329/loxaxipomoguwi.pdfIn PDF document text
    • http://xereledo.pbworks.com/w/file/fetch/144803142/la_familia_spanish_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e15ded2a-9961-4754-a65f-54890a3df69f/najevilizebofemefelil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/469d364d-3ce5-4196-b8f4-27058152ed92/kulisewinarexelekub.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8453a9b-8e82-4d9a-b9dc-34af883d6fc2/35854534520.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25703638-d3cb-438e-bd5d-12a0a498be7c/17066885933.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3304d694-e1a6-49df-8d56-ed710833e325/wd_my_passport_ultra_mac_driver.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3814da5-b50f-4cd1-819e-b871035d9a14/how_long_to_chant_nam_myoho_renge_kyo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e891.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE891 5608 bytes
SHA-256: f323fdc1bc2d72d638aa6acf5e0b5e080bf9a3b8f4bde1c1a1d69328f266fae3
font_01_sfnt_off0000fb86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB86 11420 bytes
SHA-256: c76794d4e0cb4647dd91912c0420819e9d3ff9c42a365d12f087990fdf0165cc

Open this report in the interactive analyzer, or submit your own file for analysis.