Malicious PDF — malware analysis report

Static analysis result for SHA-256 7156f3c8a91b3d04…

MALICIOUS

PDF

77.8 KB Created: 2021-03-11 22:45:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: cfb3fa3f345a9bd932073d940a6d66de SHA-1: 5fa8b2bc5c372a390ce74ac9087edeb8c9c60624 SHA-256: 7156f3c8a91b3d04c53a1f5772fbef6dd2ac1a5698606cdc38bbdcc6a68ae157
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for ClamAV detection. An external URI, 'https://botokaw.ru/strik?utm_term=is+there+going+to+be+maze+runner+4+movie', is present, suggesting a phishing or malware delivery attempt. The document body, though heavily obfuscated, contains text related to a movie search, likely a lure to disguise the malicious intent. No scripts were extracted, but the presence of external URLs and the ML/ClamAV detections strongly indicate a malicious phishing or downloader document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=is+there+going+to+be+maze+runner+4+movie PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4413978/normal_5ff3a8adce7b2.pdfIn PDF document text
    • http://skidki-day.shop/desi_chicken_farming_guidedg6ku.pdfIn PDF document text
    • https://cdn.sqhk.co/fakolafebu/igegiSE/23519531987.pdfIn PDF document text
    • http://meinekarten.best/32576151846d4d0h.pdfIn PDF document text
    • http://genusadnlo.space/51650598275dz66f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392441/normal_603f56630a25e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447647/normal_6027bf31ea473.pdfIn PDF document text
    • https://cdn.sqhk.co/ruxukulalodi/Rjg93gf/luvafotosojeteludurapigoz.pdfIn PDF document text
    • https://cdn.sqhk.co/vakusukereju/jghaCF5/47061822536.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450631/normal_600275ff945d6.pdfIn PDF document text
    • http://submonster.xyz/6_team_baseball_schedule_templateciyrg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454040/normal_5fe2b4f0d8d00.pdfIn PDF document text
    • http://moresukko.ru/resumen_de_el_libro_un_secreto_en_mi_colegiowymmq.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pevarijidasalop/8035364108.pdfIn PDF document text
    • https://efa91360-7c21-416c-9d60-3189e0beb381.filesusr.com/ugd/42ffc7_0dbc6de76da4460ea527922cbe364260.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fuwawibu/84568735452.pdfIn PDF document text
    • https://s3.amazonaws.com/xezujuxoz/chhota_bheem_game_kar_do.pdfIn PDF document text
    • https://52ed6390-a5c1-4502-9f93-599cf6d98ad1.filesusr.com/ugd/f7fbc8_e72cd870355e4ac8b06e379ce5e0dc5c.pdf?index=trueIn PDF document text
    • https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_18ab492244044159b0dd507b6f632f5d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf02b767-46b8-4ff8-b5eb-23087c81141b/45248356648.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a34b40f2-ae4e-4610-a66f-c4eb8f4f7bb1/34642635751.pdfIn PDF document text
    • https://s3.amazonaws.com/tesapibebujep/deragukozuzobipef.pdfIn PDF document text
    • https://s3.amazonaws.com/vovuzize/french_verbs_etre_and_avoir_worksheets.pdfIn PDF document text
    • https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_aaef55efc881470eaa4ad109e74106fd.pdf?index=trueIn PDF document text
    • https://8c56b32b-3398-45d6-9c0b-b55146621f16.filesusr.com/ugd/6924eb_e3d318e607da448c970fcf991cf1a06e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f17d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF17D 5344 bytes
SHA-256: 121bd1578553ac6036e0ec1fbf7ac1a2019e7797dc4b5f1046daed21f9ddf954
font_01_sfnt_off00010393.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10393 11148 bytes
SHA-256: 6e7e746f1f772cbd3a1de9df986c5773365262da2c405fb88a7b00bbabb3bce1

Open this report in the interactive analyzer, or submit your own file for analysis.