Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7fb503c2fae7cc8…

MALICIOUS

PDF

246.8 KB Created: 2021-03-14 20:49:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 1ba7241e39b39287bd5ff37b507516b5 SHA-1: ffa499a3af92f82681655f1ce06971b8188691cb SHA-256: a7fb503c2fae7cc8cbe00cee902bb3d24b6d341c6b27227c6b6bb4fea8430a40
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged by a machine learning classifier and ClamAV as malicious, exhibiting characteristics of phishing and social engineering lures. It specifically attempts to trick users into installing browser extensions or updates, or engaging with remote support tools, which are common pretexts for malware delivery. The embedded URL, https://pelibifir.ru/123?utm_term=soundcloud+er+plugin+chrome, is a primary indicator of a malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9797

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=soundcloud+er+plugin+chrome PDF link annotation
    • https://bodobazanukabub.weebly.com/uploads/1/3/4/8/134889783/nebutuxotobon.pdfIn PDF document text
    • https://pegujugadul.weebly.com/uploads/1/3/1/6/131637136/26373c7.pdfIn PDF document text
    • https://vejarava.weebly.com/uploads/1/3/1/0/131070596/9004442.pdfIn PDF document text
    • http://kumolek.22web.org/us_history_regents_exam.pdfIn PDF document text
    • https://zokolukesowi.weebly.com/uploads/1/3/0/7/130776120/deniwawobepasef-fapevuzi-xebiwuvi-bipegebabatuki.pdfIn PDF document text
    • https://gidunixodon.weebly.com/uploads/1/3/5/3/135322071/lekapisizumal_wifakuzuvi.pdfIn PDF document text
    • https://zipezeroluxufa.weebly.com/uploads/1/3/4/9/134904793/zasoli.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/25de88e5-87bc-4edc-bc2c-8d545b39f834/how_do_you_calibrate_a_torque_wrench.pdfIn PDF document text
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_f9ef76d2bdb744898ecacb8a07c01939.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa9700b9-aa7c-4fa1-aa66-29c393b5b5c8/all_of_the_following_are_phases_of_mitosis_except.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88c832d6-21c9-4be1-863a-9f44ba7d3707/how_to_draw_anime_girl_fighting_poses.pdfIn PDF document text
    • http://fodabobaxuti.epizy.com/2003_ford_windstar_transmission_fluid_change.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9056b18-40df-424b-9452-b24ba8af40f2/ruger_blackhawk_elite_pellet_air_rifle_gun_.177.pdfIn PDF document text
    • https://9c50f6df-e9c1-453e-a208-eff1cefe231f.filesusr.com/ugd/44b3dc_9381fa511825446a99ed4781d5a15384.pdf?index=trueIn PDF document text
    • http://rojapaj.epizy.com/semuxojesugulapozifuda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1656eba6-a20e-4e14-8c37-1013cb4d4a82/how_to_program_remote_to_soundbar.pdfIn PDF document text
    • https://bad3f395-1638-4667-b349-d6f934eeab49.filesusr.com/ugd/ed2d23_cc314899e5334f288e523ea069506a1f.pdf?index=trueIn PDF document text
    • http://timavutiziv.epizy.com/game_avatar_musik_pc.pdfIn PDF document text
    • https://f459ab6e-ac57-43ce-b83a-1524846427e4.filesusr.com/ugd/938c70_bb95f399806d4873b44fe20d5d43c246.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/edfb69f9-cf44-45d2-8c8b-1ad93fed3426/12222169410.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62b288a0-284f-4cbc-9c38-b14f1cb80bea/91947201552.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba57e168-2881-4177-82a3-e05e9d4dfbd3/11260698210.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62a4d1d2-504e-4033-ad65-7ded3b030c87/xavewivu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00037ebd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37EBD 5204 bytes
SHA-256: 3f8b5fcb1e3331a0e61a67ba9991cda7dfd10fdaa4d60594b9cd28c788ca1bc7
font_01_sfnt_off0003903c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3903C 2504 bytes
SHA-256: bda46a189ab5ca82e9a2dfbdd44eacc5857f8d08cd207523bdafa5b6a969d3e3
font_02_sfnt_off00039b1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39B1F 15408 bytes
SHA-256: 67234be29e236735614fc774ffb35b9a957c6fecd57433cdd3b5489573f315b5

Open this report in the interactive analyzer, or submit your own file for analysis.