Malicious PDF — malware analysis report

Static analysis result for SHA-256 93eca52e1746e827…

MALICIOUS

PDF

75.0 KB Created: 2021-03-11 19:21:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c4ffc54b87176e69ef1678992b70a5a SHA-1: e1f92fad60db85c588c4e571710f162820e241ec SHA-256: 93eca52e1746e827f3db6f9d3b0db6862b1786f8d5a4ff7b7d9ee61067c154c4
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is a PDF document flagged by ClamAV as a phishing trojan and a machine learning classifier with high confidence. It contains an embedded URL that likely leads to a malicious payload download. The presence of a 'download button' heuristic further supports the phishing lure attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/123?utm_term=amlido+dj+song PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4466664/normal_6009f4f7c2983.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465688/normal_6015c0879d713.pdfIn PDF document text
    • http://kebitax.22web.org/loxaloxuragajunabubi.pdfIn PDF document text
    • http://bisibometixo.mywebcommunity.org/1647603598.pdfIn PDF document text
    • http://mufutekuson.getenjoyment.net/jilixiveditegesoji.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/31b06199-2110-44e3-921a-9d8e8c0628ab/losixo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ef28823-aae3-44c2-9624-2e18b6c0f948/tp-link_tl-wa850re_300mbps_setup.pdfIn PDF document text
    • http://kakapefetabol.rf.gd/irrevocable_life_insurance_trust_template.pdfIn PDF document text
    • https://s3.amazonaws.com/pirofopafu/fitexunov.pdfIn PDF document text
    • https://s3.amazonaws.com/jobavo/best_android_tv_movie_apps_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/gafedupeba/master_yi_guide_op._gg.pdfIn PDF document text
    • https://s3.amazonaws.com/wulagisi/85879860568.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc0ad14b-c8e3-4351-b309-17d34641767b/vulekarodafadodejasaje.pdfIn PDF document text
    • http://soditunasi.rf.gd/vonunafiduje.pdfIn PDF document text
    • https://s3.amazonaws.com/mikibetiv/61234440243.pdfIn PDF document text
    • https://s3.amazonaws.com/timeziso/pinirabuzazewijoxuf.pdfIn PDF document text
    • https://s3.amazonaws.com/genedesowul/24180999917.pdfIn PDF document text
    • https://s3.amazonaws.com/zuxime/can_you_use_a_coffee_grinder_as_a_food_processor.pdfIn PDF document text
    • http://pivimufe.atwebpages.com/kavudarudatubupatus.pdfIn PDF document text
    • https://s3.amazonaws.com/paxuvagal/circles_life_app_android.pdfIn PDF document text
    • https://s3.amazonaws.com/divikufifir/edwina_wehjla_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e505.bin
5f3b24286705c13ba4b079b375b6ee60aa70eddf383dc4f4275cefda602aba57		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE505 4904 bytes
font_01_sfnt_off0000f5ac.bin
11a0b7a35a349b3fc1bc3d4e8863751dd9e1d0e6457d2ef1f667102cc45fba38		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5AC 12632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.