Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b875ef7adade7b5…

MALICIOUS

PDF

85.7 KB Created: 2021-04-28 09:44:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: ede8a0fad28c3e2721d6aecec8e850c6 SHA-1: 218e90fa6cb65dcd175088924bd86bfa9d0001aa SHA-256: 8b875ef7adade7b547e1ba8f77fcb12839b96cf340818513b0b499074da9896b
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as a phishing trojan. It contains an external URI and an SEO redirector link pointing to 'https://maypoin.ru/strik?utm_term=best+things+come+to+those+who+wait+quotes', suggesting a phishing lure. The document body, though heavily obfuscated, contains text related to quotes, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=best+things+come+to+those+who+wait+quotes PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4374710/normal_606377a933af5.pdfIn PDF document text
    • https://cdn.sqhk.co/zetoreli/ew3hbOz/dope_live_wallpaper_hd_android_anime.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497370/normal_6022297349822.pdfIn PDF document text
    • https://cdn.sqhk.co/rixakowu/hc2i8gg/gogusidijenonaluk.pdfIn PDF document text
    • http://mobutadaxez.medianewsonline.com/silewajizagimewojabosuti.pdfIn PDF document text
    • http://xikisavi.scienceontheweb.net/clasificacion_de_los_animales_domesticos.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/batiku/free_4th_grade_reading_comprehension_worksheets.pdfIn PDF document text
    • http://xovefopu.myartsonline.com/akademia_pana_kleksa_test_z_odpowiedziami.pdfIn PDF document text
    • https://s3.amazonaws.com/mojivikapeti/how_to_check_food_stamp_balance_ohio.pdfIn PDF document text
    • https://s3.amazonaws.com/goveruduzewoxu/nancy_drew_movie_2019_songs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e71770c-e485-48f5-90e4-656347f5cdc5/romance_of_the_three_kingdoms_game_switch.pdfIn PDF document text
    • https://s3.amazonaws.com/dosalapasenow/nasadedawapanudum.pdfIn PDF document text
    • https://s3.amazonaws.com/betefowubevat/android_studio_install_in_ubuntu_14._04.pdfIn PDF document text
    • https://s3.amazonaws.com/purixifusipelid/imagenomic_portraiture_free_photoshop_cs5.pdfIn PDF document text
    • https://s3.amazonaws.com/gidibesuxi/top_10_android_mobile_phones_under_30000.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5a0398d-acdd-4c97-b960-eeb178c03ede/etapas_del_proceso_de_investigacion_documental.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70ef8a8c-8277-4cac-94d9-073df8dbbc0d/what_are_the_social_problems_seen_in_your_society_list_them.pdfIn PDF document text
    • https://s3.amazonaws.com/dikobepibelun/balam_pichkari_hd_video_song_pagalworld.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/564c11fd-f411-4aa7-bbd7-c71def3b4fe6/flysky_fs-gt3c_binden.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4a0c677-5803-4848-81ab-dd85d4d8109f/38735801118.pdfIn PDF document text
    • https://s3.amazonaws.com/zijivevip/how.much_do_consultants_make.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F79 5352 bytes
SHA-256: 3efa95fa8814db8c0ea4fde423b4ab0c1fca481cfb155357094f3d6ebebeae40
font_01_sfnt_off000121a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121A3 11176 bytes
SHA-256: c6a4acef01940f598a5bf3d1f708c6e7fdec89d82853112b3ad3b50734e6fa92

Open this report in the interactive analyzer, or submit your own file for analysis.