Malicious PDF — malware analysis report

Static analysis result for SHA-256 767b7efe609a5d47…

MALICIOUS

PDF

65.5 KB Created: 2021-02-26 22:29:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: beec756da5cada6ac5423422291fef92 SHA-1: 9b73aaf6afe2c69406947cf0a4e4762081567bf4 SHA-256: 767b7efe609a5d475e00f888c555fd66d1997fe18cf669f684c5787fe587e740
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by both ML classifiers and ClamAV as malicious. The document body, though heavily obfuscated, appears to reference a manual, suggesting a lure to trick users into visiting the malicious link. The presence of external URIs and the overall detection by multiple engines strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9585

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=hamilton+beach+roaster+oven+model+527w+manual PDF link annotation
    • https://cdn.sqhk.co/jixavome/ixjiKjb/juicy_simulator_blend_it_icy_drink_simulations.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369657/normal_5fee89882a796.pdfIn PDF document text
    • http://pukogika.iblogger.org/witeselelananiditewesere.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417208/normal_5fecc141a538d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414696/normal_6033b935f1d35.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474192/normal_5fed1389e9231.pdfIn PDF document text
    • https://cdn.sqhk.co/moxibusas/jgthfkX/5149055831.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444850/normal_5ff49b14e6031.pdfIn PDF document text
    • https://cdn.sqhk.co/dajebala/gigifjj/hot_rod_garage_philly_location.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tefadipa.epizy.com/life_in_pieces_episode_guide_season_4.pdfIn PDF document text
    • http://wigapezurujeva.rf.gd/teaching_students_with_special_needs_in_inclusive_settings_fifth_canadian_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/juwofuxufijup/vasiwi.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc9b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC9B 5768 bytes
SHA-256: ee6fd0e6207829881c22b6fc0581dc413b63c2a90d03765b252ca1919300136b
font_01_sfnt_off0000e029.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE029 10160 bytes
SHA-256: bac3345f9d2035547c7d10c1fc3f61f4649e98bd029975a5bafa6716cca162fa

Open this report in the interactive analyzer, or submit your own file for analysis.