Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7543b2eb62bd28e…

MALICIOUS

PDF

75.7 KB Created: 2021-02-27 07:52:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: bff28cf294540d75d18610aec6cf9f8c SHA-1: 0cb8d4bcebd3ffd402677f572de819a39eb2ffd0 SHA-256: a7543b2eb62bd28e4d1e6ab225841b7cca70594d1038c57298fceaa0014d68d1
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that directs the user to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URI suggest it's designed to trick users into visiting a malicious site, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=tommy+emmanuel+the+mystery+full+album PDF link annotation
    • http://ogranicbio.space/potadexum3waik.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454419/normal_5feca15124a97.pdfIn PDF document text
    • http://app-3null.com/death_anniversary_invitation_templatexf2s4.pdfIn PDF document text
    • http://hookup681.site/super_wings_police_plane_namenqfjd.pdfIn PDF document text
    • http://cupe1.ru/pugidalojuwirmtjrs.pdfIn PDF document text
    • http://redirunna.xyz/yamaha_rx_v6710ghxv.pdfIn PDF document text
    • http://reduslim-officialsite.site/best_bitcoin_miner_app_android4rden.pdfIn PDF document text
    • http://reetodo.online/the_confessions_of_st_augustine_audiobook4urfc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461485/normal_60034116eb2a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456122/normal_5fdc65b14f536.pdfIn PDF document text
    • http://koreanluxe.com/bouncy_chair_babyoshyf.pdfIn PDF document text
    • http://it50life.pro/autel_autolink_al319_user_manualbwboj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tirimofufemukat/85037259265.pdfIn PDF document text
    • https://s3.amazonaws.com/bevarolimesale/wedding_invitations_templates_free_online.pdfIn PDF document text
    • https://s3.amazonaws.com/mujesogi/riwalaxilozuxuno.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/vararuwuni.pdfIn PDF document text
    • https://s3.amazonaws.com/xunilukegez/aluminum_sheets_for_enclosed_trailer.pdfIn PDF document text
    • https://s3.amazonaws.com/tevomenil/ielts_writing_answer_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/gulapore/pediatric_pneumonia_guidelines_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/kitivad.pdfIn PDF document text
    • https://s3.amazonaws.com/vukujidor/sunfish_mainsheet_bridle.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB46 4492 bytes
SHA-256: 10ce55bd5d7f5990c92a77313af78f1adf2cfa91561038d3e0f72f1894ea6ee6
font_01_sfnt_off0000eadf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEADF 5196 bytes
SHA-256: de0f4e90af409a7546d39342404983fa0e04155a0422a469c6c190d5987e87f5
font_02_sfnt_off0000fc64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC64 10736 bytes
SHA-256: 6a7b5c115633317f3290d4a826f025e165c6e6006711076561e66618a17cb77c

Open this report in the interactive analyzer, or submit your own file for analysis.