Malicious PDF — malware analysis report

Static analysis result for SHA-256 723a9ee539639082…

MALICIOUS

PDF

77.4 KB Created: 2021-03-18 07:13:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: c656a32f50b131088c6299696b1b797b SHA-1: c9481f1c682ba4a2a001d48528d017b0d299b519 SHA-256: 723a9ee5396390822bd1245ad9a323d0e2e0db9c06b18db08849d16f26d11599
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, specifically as a phishing or trojan. The document contains an embedded URI that redirects to a suspicious URL, likely for a phishing or malware distribution campaign. The presence of the 'ML_NYX_PDF_MALICIOUS' and 'CLAMAV_DETECTION' heuristics strongly indicates malicious intent, and the 'PDF_SEO_UTM_REDIRECTOR_LINK' heuristic points to a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=factory+reset+asus+router+rt-ac87u PDF link annotation
    • https://cdn.sqhk.co/puxolika/haiig4u/57843974517.pdfIn PDF document text
    • https://cdn.sqhk.co/jorisuzil/dAdbxhd/call_of_magic_best_heroes.pdfIn PDF document text
    • https://cdn.sqhk.co/demawanetufi/4Xghgje/wilderness_survival_skills_book.pdfIn PDF document text
    • https://cdn.sqhk.co/vizakifito/Xieiajj/time_travel_movies_on_hulu.pdfIn PDF document text
    • https://cdn.sqhk.co/zolulesar/hijiWgc/jajufupazumikozokot.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3dc1c4ff-a738-468f-a062-802a94f5054c/kitchenaid_30-inch_smooth_surface_double_oven_electric_range_reviews.pdfIn PDF document text
    • http://besenasoxa.epizy.com/vcredist_x86_2._exe_2015.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be224300-9ba3-4fd8-8870-c9c1f944bba8/31302575759.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45dd7559-6d0c-4fc1-8996-a9e555c6f12e/how_to_read_oxygen_flow_meter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f2addc5-c95b-43a2-be5e-acf84c042407/pride_and_prejudice_1995_movie_online_with_english_subtitles.pdfIn PDF document text
    • http://sofidubanelen.epizy.com/xogobufikamu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ccb34a2-3fa9-449a-b32a-56e7ccdc46e7/can_vizio_tv_connect_to_bluetooth_headphones.pdfIn PDF document text
    • https://s3.amazonaws.com/mikibetiv/ambiguous_sentences.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dce770f2-347a-4986-993e-8eb1c0ef6192/62883044719.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/aflac_dental_claim_form_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0AE 5124 bytes
SHA-256: 314d9f29089df0cfa90413ee0e204cb25bac87b5bac0b5310f2f6614348a337e
font_01_sfnt_off00010242.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10242 11204 bytes
SHA-256: 048c96e31500a6a67b00fe89d6590b1b4cc162ec703c313b3d21a5c0e18deada

Open this report in the interactive analyzer, or submit your own file for analysis.