Malicious PDF — malware analysis report

Static analysis result for SHA-256 9536a0eb7a77cb04…

MALICIOUS

PDF

74.0 KB Created: 2021-04-25 16:16:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 0437936b2228676cf84dfabd7828277d SHA-1: f2852630aeab08d06d0fb290670e64a375a7d57c SHA-256: 9536a0eb7a77cb041da2e03413ebf3320c42e0c057e82367a266696dc7e091d9
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, specifically using an image to redirect users to a malicious URL. The embedded URL and the document body, though heavily obfuscated, suggest a pretext related to network device compatibility to trick users into clicking the link. The ClamAV detection further confirms its malicious nature as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9769

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=is+netgear+nighthawk+ac2600+compatible+with+spectrum PDF link annotation
    • http://xegazinijitup.mywebcommunity.org/8380312980.pdfIn PDF document text
    • https://cdn.sqhk.co/kevovevude/fhjnXgc/happier_music_video_marshmello_lyrics.pdfIn PDF document text
    • http://suzofovolavuk.scienceontheweb.net/family_feud_game_template_google_slides.pdfIn PDF document text
    • https://cdn.sqhk.co/guludagew/XUNvUjh/aol_email_app_for_android_tablet.pdfIn PDF document text
    • https://cdn.sqhk.co/pirujezexod/fFbThfs/zifavuj.pdfIn PDF document text
    • https://cdn.sqhk.co/titolegun/Bjh0hd5/fresh_tri_cost.pdfIn PDF document text
    • https://cdn.sqhk.co/nogawevorus/gchcqgc/hachiko_movie_free_download_in_tamil.pdfIn PDF document text
    • https://cdn.sqhk.co/nazujovo/ijhzb0m/samuel_huntington_clash_of_civilizations_summary.pdfIn PDF document text
    • https://cdn.sqhk.co/suwapipejob/XayeEcE/jitov.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7d61e09-3a40-4105-ad2c-2aed6a2807b8/small_xfinity_cable_box_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1bd62b00-513b-4ebc-9c28-1a10f0cefa6e/new_free_wordpress_themes_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2d64a4a-f7bc-4801-a12c-d3077a036180/consider_the_infinite_geometric_series.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9310410-6cd1-48a6-b315-c117d25edbe5/how_to_draw_a_realistic_rose_step_by_step_for_beginners.pdfIn PDF document text
    • https://s3.amazonaws.com/tezude/baxakutiwazorojenubus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b9b1fbd-7853-48db-8542-9ef1607beeff/keirsey_temperament_sorter_test.pdfIn PDF document text
    • http://bodegifu.atwebpages.com/partnership_deed_format.pdfIn PDF document text
    • https://s3.amazonaws.com/matogapibelifiv/cybernetica_datasmith_datasheet.pdfIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/wedufa.pdfIn PDF document text
    • https://s3.amazonaws.com/davawina/purple_silver_eyeshadow_tutorial.pdfIn PDF document text
    • https://s3.amazonaws.com/lopadivupudexa/movie_4_android_hollywood_bollywood_south.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC6F 6008 bytes
SHA-256: 997a6882cf21816755ca8d99148e3c578f918c2bd842626fb6564cfa6d7cf716

Open this report in the interactive analyzer, or submit your own file for analysis.