Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d9015e12de14720…

MALICIOUS

PDF

78.2 KB Created: 2021-03-30 00:40:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b6d528c9c3204a7388cb3718d739d3ab SHA-1: 785701e5dcf5fe1e42f3a14958c3840731404d9a SHA-256: 6d9015e12de14720f46a52c7d234a728d9a3067964abf0db882d03ac800280c1
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL leading to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, suggests a lure related to 'alphanumeric codes' and 'award', consistent with phishing or scam attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=alphanumeric+codes+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4410414/normal_600a9b29aeeca.pdfIn PDF document text
    • http://kixiwogazu.sportsontheweb.net/wix_add_files_to_google.pdfIn PDF document text
    • http://about-central.com/75313527200lulb7.pdfIn PDF document text
    • http://pro-gram.pro/bastien_piano_book_3gmboa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4498702/normal_6013479421ff8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408333/normal_6039f775e4391.pdfIn PDF document text
    • http://ellmax-site.xyz/940742939408n9ep.pdfIn PDF document text
    • http://myimperfectmomlife.com/moninawewidijetagc0ipj.pdfIn PDF document text
    • http://cetakchantek.com/soxibopajinorejivasiplpvkn.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1667780e-57d3-4c88-9603-b549ac708874/what_element_has_two_valence_electrons.pdfIn PDF document text
    • https://s3.amazonaws.com/fezenur/80776218900.pdfIn PDF document text
    • https://s3.amazonaws.com/sifawekujiki/baby_girl_party_dresses_9-12_months.pdfIn PDF document text
    • https://s3.amazonaws.com/risalenefazozo/how_to_find_the_surface_area_of_prisms_and_cylinders.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f853797-18cd-41e8-8fcf-ba47ba42237f/mimazuvedekapofofefom.pdfIn PDF document text
    • https://s3.amazonaws.com/fikuvine/resistors_capacitors_and_inductors_information.pdfIn PDF document text
    • https://s3.amazonaws.com/bejokazemur/mobaxazilosimuxoveguj.pdfIn PDF document text
    • https://s3.amazonaws.com/jevelel/pajobaxobadulexava.pdfIn PDF document text
    • https://s3.amazonaws.com/fekaduvopigab/maxwell_s_wave_equation.pdfIn PDF document text
    • https://s3.amazonaws.com/xupovobejanam/robuporuliwavar.pdfIn PDF document text
    • http://lukafimagog.atwebpages.com/referencias_bibliograficas_para.pdfIn PDF document text
    • https://s3.amazonaws.com/vonutavekip/raju_bhai_songs_telugu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eec9.bin
02eb7cd720512007050aa24738748967f0503cb10e0f6de6c986b1b962f1c91f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEC9 5384 bytes
font_01_sfnt_off000100ea.bin
b80ccc2e84683ed91c897142174ed107f05acb05c963f96bf6674fdfd0ad5a74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100EA 12480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.