Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ab203ff633b8f85…

MALICIOUS

PDF

76.5 KB Created: 2021-05-21 20:11:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: b187ef353ef3ddb9857a20feed463341 SHA-1: 128d9b906e485f3e09193213f3d5d087a5b7e717 SHA-256: 8ab203ff633b8f85af4cdbeea66522b43776741a89b080040b86b75059540206
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to file conversion, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+to+convert+a+pdf+file+to+word+on+mac PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4391331/normal_6033a33e11c31.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482418/normal_5fedfc6b556a0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373779/normal_60302ebd4dd02.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447250/normal_6015fdd33c35e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410678/normal_6052237f8c63f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465125/normal_5feffcdb7a471.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383692/normal_5fd92f66f0148.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3d0c3a6-424c-43e2-92c1-ccc172fe77dc/when_does_wu_tang_come_back_on.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17370d65-3878-498c-b2d6-b7e005d18d19/buwelavo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cdbd5333-8e4f-4e71-872a-7f2b1fc00dbf/is_all_souls_day_a_public_holiday.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4dde8e76-0772-4699-8274-74fb17565a4d/why_does_my_vizio_tv_have_a_blank_screen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44d1493a-0632-4158-aa3b-eb8e3670367a/pezikutotodivejejira.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ce3fca2-e2ce-4a47-8666-b46d6828d882/what_is_the_best_stock_broker_for_beginners_australia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/308b1103-3800-4d15-8281-a50314000ab8/informative_speech_outline_template_google_docs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d0adbf9-5774-478d-92b0-2139575ed4d5/tom_clancys_rainbow_six_vegas_2_trainer_v_1.03.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6887ba92-a2aa-4dec-b14c-11a142d689ca/57997358715.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0537757a-b809-4e38-a36c-1925ab071f6c/how_to_use_clean_function_on_mr_coffee.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9127c34-949a-4592-8e2e-34e2334dc943/kijuwopupuwipaxakodugede.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c640cec9-8829-4aae-ae90-4574b76899bd/70551668217.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3df145b8-c80a-47af-b929-6fc56df04ae6/mofubuza.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED73 5236 bytes
SHA-256: ddc06c6dfd46e353a0d81b560be7d6abda8a32db5330e62c15cfb4be24ab8e33
font_01_sfnt_off0000ff49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF49 10964 bytes
SHA-256: 4f1a9ac8c8e116866310a3286f52e49491ffc7a5f8367fae46a2c5833429b1fe

Open this report in the interactive analyzer, or submit your own file for analysis.