Malicious PDF — malware analysis report

Static analysis result for SHA-256 7199983f432d9f74…

MALICIOUS

PDF

77.3 KB Created: 2021-01-23 05:47:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 4ca99bdeb39bce99b4d432be7390ec48 SHA-1: 9097c25126642084a82311e8c5adab0543ad69c7 SHA-256: 7199983f432d9f74c888a7c3bbfc7982bf8aa643b8d42cc75093ba2b1ed54140
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a URL that appears to be a lure for 'woodworking projects plans pdf free'. The presence of PDF-specific heuristics and the nature of the embedded URL suggest an attempt to exploit vulnerabilities or trick the user into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/wb?keyword=woodworking%20projects%20plans%20pdf%20free PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4470833/normal_5fe053c6bd8a2.pdfIn PDF document text
    • http://fivogudog.iblogger.org/funeral_pamphlet_templates_free.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374839/normal_5fcf518ccf92c.pdfIn PDF document text
    • https://cdn.sqhk.co/baluwofuk/6GmFrif/34440743042.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461516/normal_5fd1055e705c4.pdfIn PDF document text
    • http://banoduber.iblogger.org/72795944551.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386087/normal_5ff65df377ab2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426944/normal_5fef4eeb8f192.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366302/normal_5fff0e8f93e61.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422134/normal_60089b02aa14d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381289/normal_5fda3d2626956.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://surifuj.rf.gd/niwus.pdfIn PDF document text
    • http://zozoresupiz.epizy.com/net_a_porter_email_address_format.pdfIn PDF document text
    • http://sikofus.epizy.com/addition_of_integers_examples_with_answers.pdfIn PDF document text
    • http://gugamofizuxeg.epizy.com/95066943114.pdfIn PDF document text
    • http://lajirobodogew.epizy.com/tamilrockers_latest_telugu_movies_2019.pdfIn PDF document text
    • http://zukusuvajijip.epizy.com/zonigobalepi.pdfIn PDF document text
    • http://magikid.epizy.com/gigat.pdfIn PDF document text
    • http://lisokabosexipep.epizy.com/chicago_bears_vs_eagles_injury_report.pdfIn PDF document text
    • http://rajixubododafu.epizy.com/bangladesh_population_census_2001.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f07f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF07F 5568 bytes
SHA-256: 3384e1aa02404ce83637e7ee9f00fcc9ca3d401c2d917ea42763b8c8da2ce2b9
font_01_sfnt_off000103a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103A7 10692 bytes
SHA-256: 33b0070620182fe26dc80aa60a03ac8b3f005de6fe188c2c1bb27ecdcfe52320

Open this report in the interactive analyzer, or submit your own file for analysis.