Malicious PDF — malware analysis report

Static analysis result for SHA-256 91ca7c2f74123418…

MALICIOUS

PDF

82.9 KB Created: 2021-01-25 16:11:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: a0464c6d149aeec7c85c07b7f93496bc SHA-1: 2fca5216815e40b1bd35e8fd366e19ffed41f6b3 SHA-256: 91ca7c2f741234182b04ccda482aa5f10d7ea29ae820d8ab23da4680df17c679
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.007 JavaScript

The file was detected as a malicious PDF by ClamAV and an ML classifier, exhibiting characteristics of callback phishing or tech-support scams. The document body, though truncated, contains a URL that appears to be part of the lure. Multiple embedded URLs were extracted, suggesting the document may attempt to redirect the user to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=cet+davv+2018+application+form PDF link annotation
    • https://cdn.sqhk.co/ributexovek/5gfja7O/vodokokaseg.pdfIn PDF document text
    • https://cdn.sqhk.co/rifusofuwedi/hbJjahe/principal_mining_engineer_salary_australia.pdfIn PDF document text
    • https://cdn.sqhk.co/mosugukasiba/IhfPggh/sisters_oregon_fire_2020.pdfIn PDF document text
    • https://cdn.sqhk.co/xeduwukaxusa/HtjehbX/fosuwonu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416675/normal_5ffd62db7d460.pdfIn PDF document text
    • http://strita.space/rolakefaxlc2g.pdfIn PDF document text
    • https://cdn.sqhk.co/vibisidumes/ifGjrgd/minecraft_java_edition_cheap_g2a.pdfIn PDF document text
    • https://cdn.sqhk.co/buzunonoj/ij4hh72/dakosiwanalufolesukazufa.pdfIn PDF document text
    • http://viwimewi.22web.org/dopagipesawetid.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4423148/normal_5feea01b0a8dc.pdfIn PDF document text
    • https://cdn.sqhk.co/xelalizogim/iIhdwhb/types_of_antibiotics_for_skin_infections.pdfIn PDF document text
    • https://cdn.sqhk.co/libibajuzumu/VWJpI4j/41953011272.pdfIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tuwesexo.epizy.com/23868190747.pdfIn PDF document text
    • http://juxugalipexobow.epizy.com/badminton_technique_tactics_training.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00012b7d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12B7D 5180 bytes
SHA-256: d40e6fdb8019280f37e447c26532157e73e4959c54de191ee39b25ea5024e0ad
font_00_sfnt_off0000da33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA33 5608 bytes
SHA-256: ff4085bfaf99d086550edaf37a86858433b9336959b81009f4d74b4d7837bfd5
font_01_sfnt_off0000ed3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED3D 12132 bytes
SHA-256: 2654d1811d63a13627abf6f8c4428994bfdd512771a5664086178c98b0147cb5
font_02_sfnt_off00011648.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11648 16132 bytes
SHA-256: 2def80ee9cf871b89fa1821d83521187f92649b88f41053709a5a2c79b3e7c85

Open this report in the interactive analyzer, or submit your own file for analysis.