Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0a2caabad51f419…

MALICIOUS

PDF

77.1 KB Created: 2021-04-02 10:40:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 70b5d4d8ed547ec25302cc848401b45a SHA-1: e5bbe6748cab74a2d3ae7caf0129929282856cca SHA-256: b0a2caabad51f41993b8aac37aced3b48f6a5f9e59e39503c75c7ae91c486008
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, contains text related to gaining muscle mass, suggesting a lure to entice clicks on the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=como+ganar+masa+muscular+de+forma+natural PDF link annotation
    • http://lassituda.online/576080385504e44f.pdfIn PDF document text
    • http://gravkamen.ru/data_structures_and_algorithms_coursera_quiz_answersffn1l.pdfIn PDF document text
    • http://vuxijagodoku.22web.org/55997682435.pdfIn PDF document text
    • http://tiktokfrance.fun/feed_us_5_unblocked_games_77946vy.pdfIn PDF document text
    • http://help-lnstagramcopyrights-verify.com/free_wallpaper_liverpool_fc_for_pcosfn4.pdfIn PDF document text
    • http://lanejaselisipu.22web.org/gifufidideditosow.pdfIn PDF document text
    • http://fordist.ru/plataforma_educamos_colegio_cervantes_talaveraxxj90.pdfIn PDF document text
    • http://vkrowl.com/dometic_ac_thermostat_conversion_kitjos8i.pdfIn PDF document text
    • http://luminar3-download.xyz/leaving_the_body_a_practical_guide_to_astral_projectioncstc0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2a5cfb3-2628-47da-a50d-84c58d897de3/48834684569.pdfIn PDF document text
    • https://s3.amazonaws.com/gajakelegeza/93567544197.pdfIn PDF document text
    • https://s3.amazonaws.com/zidosozawok/all_souls_college_postdoctoral_fellowship.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c13b875-023b-456f-a480-3689b49da037/hnsel_und_gretel_film_netflix.pdfIn PDF document text
    • https://s3.amazonaws.com/fogibi/norton_anthology_of_english_literature_volume_2_10th_edition.pdfIn PDF document text
    • http://tapejufujol.epizy.com/how_to_clean_the_technivorm_moccamaster_coffee_maker.pdfIn PDF document text
    • https://s3.amazonaws.com/jezobasit/10_000_reasons_jonas_myrin_and_matt_redman_lyrics.pdfIn PDF document text
    • http://befojarariwowab.epizy.com/25049821611.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/85d2882a-d1c0-4abf-ac4f-4b0dc8252d54/65619958983.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f3b5470-615c-4276-9803-c26d52715591/vumisavasarusobonofit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eead.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEAD 5248 bytes
SHA-256: 16b11597184531c7d15701879ae7f62d7c97af95bd74d2e117013771ee6c88fe
font_01_sfnt_off0001006b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1006B 11396 bytes
SHA-256: ee2492335c2a844866363ea252adb86c54913ee581f12bcdd29176e152e8185f

Open this report in the interactive analyzer, or submit your own file for analysis.