Malicious PDF — malware analysis report

Static analysis result for SHA-256 7806ae02e5971d50…

MALICIOUS

PDF

79.3 KB Created: 2021-03-08 13:01:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 98364622ccd5f17ad4567bbe9ea8c8bf SHA-1: 21437758c1458f6bbd9c9222b3e5e444cd4e4de3 SHA-256: 7806ae02e5971d508e0397f2fc3ed661bed9082433d6d88e7c37c45aec378dc4
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of multiple external URIs, including one that appears to be a lure for a 'solar system labelling worksheet', suggests a phishing or social engineering attack. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the overall context points to a malicious PDF designed to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=solar+system+labelling+worksheet PDF link annotation
    • http://gebevojika.mygamesonline.org/23297842173.pdfIn PDF document text
    • https://cdn.sqhk.co/kelufuro/QGLjagf/snake_eyes_2020_imdb.pdfIn PDF document text
    • http://xufededubumavif.scienceontheweb.net/ryujin_3.5.pdfIn PDF document text
    • http://keepmaxi.space/bopirufhw9jn.pdfIn PDF document text
    • http://help-violation.com/an_inspector_calls_chinese_movie_review9a3kd.pdfIn PDF document text
    • http://watulexop.iblogger.org/how_to_cut_a_rabbet_joint_with_a_router_table.pdfIn PDF document text
    • https://cdn.sqhk.co/sixatowitur/bicFjiu/birthday_cake_decorated_sugar_cookies.pdfIn PDF document text
    • https://cdn.sqhk.co/surixirulol/IgjgRhd/20995767258.pdfIn PDF document text
    • http://lobabinuladeri.medianewsonline.com/64906471435.pdfIn PDF document text
    • http://terugate.mypressonline.com/xamesigenejatelib.pdfIn PDF document text
    • https://cdn.sqhk.co/kewawukufiju/jhhBcjf/84885189597.pdfIn PDF document text
    • https://cdn.sqhk.co/tezizejaropu/iFSgid4/stickman_ghost_2_gun_sword.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4545f21-45f9-4ab5-bf36-d2b07fe30dd3/13568676006.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfbb5979-5542-4f33-8183-88f1ae288b23/from_a_passage_to_africa.pdfIn PDF document text
    • http://pejasevolebik.rf.gd/43531359034.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01ea3e5b-6ee1-43bb-8940-d3071f81b1ab/medios_de_comunicacion_actuales_y_antiguos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78b00ed4-a53a-47b9-b245-1729e576650a/interactive_charting_outcomes_of_the_match.pdfIn PDF document text
    • http://turakolop.rf.gd/89032980844.pdfIn PDF document text
    • http://netupabajezi.rf.gd/world_war_z_book_ending.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92dd98b9-5192-4e21-8b63-bd410990c1ff/tukavilugulakedekivo.pdfIn PDF document text
    • http://botemunem.epizy.com/marriage_license_application_california.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c651e5e-a1db-476f-998f-d256e58d0816/sundara_kandam_tamil_movie_video_songs_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9931501-cb93-4e05-9a5b-ea6a2a5839fa/the_ransom_of_red_chief_summary_characters.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bad6d7e9-45b9-4d19-b134-66127d61688a/pokugazowe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f81c.bin
7bc8be63be0f9050e8414e1bcbc170324236c3f600f120b7dab55530498d1545		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF81C 5600 bytes
font_01_sfnt_off00010b11.bin
172ce949a6411d487357f73983b2032792c084eaf424c12e795aaa0f545b5a38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B11 11028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.