Malicious PDF — malware analysis report

Static analysis result for SHA-256 a324a36274bb2b6e…

MALICIOUS

PDF

88.7 KB Created: 2021-04-26 00:54:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: bfc656ee8b25e92cc3237f35a3826d5c SHA-1: 9fc1e70b2160a010323cf37e97c77d307bb7dd85 SHA-256: a324a36274bb2b6ef0a67266520070560174235dc5859d202f9fb2dfa342c86b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely the primary lure. While no scripts were extracted, the presence of external URLs and the high confidence detection scores suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=savarez+t50j+nylon+classical+guitar+strings+high+tension PDF link annotation
    • http://vazewuxu.mywebcommunity.org/jelosojivikejanowaso.pdfIn PDF document text
    • http://insta-sale.site/4461809966ue9st.pdfIn PDF document text
    • http://xomapometafa.iblogger.org/lagu_senorita_free_stafaband.pdfIn PDF document text
    • http://wowitaly.pro/21445327623peu2d.pdfIn PDF document text
    • http://rowomonug.mywebcommunity.org/what_pros_use_project_x_lz_shafts.pdfIn PDF document text
    • http://matepiruzozu.iblogger.org/fenotefetujegiwilel.pdfIn PDF document text
    • http://keluzizizeroki.getenjoyment.net/nakofepobuguwanafesirego.pdfIn PDF document text
    • http://baranaydin.org/avatar_258_auto_farm_apk5kqlh.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/84dedb24-fc7d-4e5b-92fa-df6b98d6c166/5217524509.pdfIn PDF document text
    • https://s3.amazonaws.com/feborobegibew/caa_thomas_cook_refund_form.pdfIn PDF document text
    • https://s3.amazonaws.com/kujapomib/hypoglycemia_treatment_guideline.pdfIn PDF document text
    • http://releboxodaw.rf.gd/computer_awareness_mcqs_book_free_download.pdfIn PDF document text
    • http://kabuzore.atwebpages.com/vision_ias_current_affairs_april_2020_in_english.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef53e3a1-f976-483c-8b23-0e0ca0c29ea7/garmin_gpsmap_64_manual_espaol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdc9b039-4b2b-439f-8253-fd7b147a9cb1/duxosonu.pdfIn PDF document text
    • https://s3.amazonaws.com/gogunabones/92329223238.pdfIn PDF document text
    • http://sesumedafe.epizy.com/blue_parrot_b250xt_amazon.pdfIn PDF document text
    • https://s3.amazonaws.com/muwemivumazulax/32651811624.pdfIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/lenowowuvimesavikufiri.pdfIn PDF document text
    • http://sanugifop.atwebpages.com/what_is_the_theme_or_message_of_the_gettysburg_address.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d0a244b-bd0b-48d6-8397-81d5c942185a/xasaka.pdfIn PDF document text
    • https://s3.amazonaws.com/wurivuve/farodera.pdfIn PDF document text
    • http://gofosuxubajo.epizy.com/list_of_beta_lactam_antibiotics.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011bb5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BB5 5716 bytes
SHA-256: 63a6ca71b9f0e414d0229fa1b1e1f89e53ce6def3b98bc7adde914035c88bc98
font_01_sfnt_off00012f3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F3F 11152 bytes
SHA-256: 29c87b38f8d32b0ab2cdb8f7e26d65f429692691dd2f76849235949bb8b138ed

Open this report in the interactive analyzer, or submit your own file for analysis.